Recommended Netflow Configuration for Cisco IOS 15
Eric Pancer via Argus-info
argus-info at lists.andrew.cmu.edu
Thu Nov 5 20:17:08 EST 2015
Thanks, Carter! Okay, so we went with the following flexible Netflow
configuration using standard v5 records but v9 as the exporter.
flow exporter flow-export-west
transport udp 2055
flow monitor flow-monitor-west
By the way, just for the archive: turns out the Cisco ISR 4000-series
cannot send flow data via the management interface/management VRF.
Would have hoped this could have been separated out, but it just
didn't work out.
On Fri, Jul 10, 2015 at 9:36 AM, Carter Bullard <carter at qosient.com> wrote:
> Hey Eric,
> Long time-no-read !! Argus-clients-3.0.8 should read netflow v5 and v9, but v9 is always subject to further testing, as some of the data is pretty weird, like using a template that has ports in it for traffic that is not TCP or UDP. Give it a try with V9, if you need the data ... V5 should be solid.
> If anything comes up don't hesitate to holler ...
> Hope all is most excellent,
>> On Jul 10, 2015, at 9:01 AM, Eric Pancer <epancer at pobox.com> wrote:
>> It's been a good bit of time since I've been on a Cisco device to
>> configure netflow and I see IOS15 has changed the command set. What's
>> the best recommend you folks have for enabling netflow on a late model
>> router so that they can be read by Argus? Is v9 supported fully yet or
>> should I stick with v5?
>> These commands are what I came up with:
>> flow exporter NETFLOW
>> description Hello Carter!
>> destination 10.1.1.25
>> export-protocol netflow-v5
>> ttl 15
>> Of course I'm still running into a few other issues with getting this
>> applied to an interface (including needing to have a valid flow
>> record), so any tips are appreciated.
>> - Eric
More information about the argus