Catalyst 4500-X 上的 NetFlow 配置

网络工程 cisco催化剂 网络流量
2021-07-27 19:21:44

我在 4500-X 交换机上配置 NetFlow 时遇到问题。

这是 NetFlow 配置

flow record NFArecord
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input netflow
 match interface output netflow
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
!
!
flow exporter ELK
 destination 172.17.214.33
 transport udp 9966
!
!
flow monitor NFAmonitor
 exporter ELK
 cache timeout inactive 30
 cache entries 10000
 record NFArecord
!

我想收集 vlan 间流量的记录。

尝试这样做:

interface Port-channel2 
//this is port-channel to SW3750, want to collect ingress traffic on in interface
 description Trunk to 6floor
 switchport
 switchport mode trunk
 end

Core-4500x(config-if)#ip flow monitor NFAmonitor in
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

好的,尝试将 ip flow 应用到 vlan 60 并得到相同的结果:

Core-4500x(config-vlan-config)#ip flow monitor NFAmonitor input 
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

Core-4500x(config-vlan-config)#ip flow monitor NFAmonitor layer2-switched input 
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

怎么了?我应该为 NetFlow 工作做些什么?

1个回答

从您的错误看来,某些流记录不能用于第 3 层流捕获。

试试这个配置。它将应用于桥梁级别。

flow record FLOW-RECORD-IPV4
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect interface output
 collect counter bytes long
 collect counter packets long

flow exporter FLOW-EXPORTER-X.X.X.X
 description FLOW-EXPORTER X.X.X.X
 destination X.X.X.X
 source VlanX
 transport udp 2055

flow monitor FLOW-MONITOR-IN
 description MONITOR INGRESS FLOWS
 record FLOW-RECORD-IPV4
 exporter FLOW-EXPORTER-X.X.X.X
 cache timeout inactive 60

vlan configuration 10,20,30,40,50,60
ip flow monitor FLOW-MONITOR-IN input

您也可以在界面级别应用它:

interface GigabitEthernet1/3/1
 ip flow monitor FLOW-MONITOR-IN input