Recommended Netflow Configuration for Cisco IOS 15

[Carter Bullard via Argus-info]

Hey Eric !!
Glad to see that you're still computing !!!!  
If  anything interesting comes up ... don't hesitate to holler !!!
Carter
	 	
Carter Bullard • CTO
150 E 57th Street Suite 12D
New York, New York 10022-2795
Phone +1.212.588.9133 • Mobile +1.917.497.9494

> On Nov 5, 2015, at 8:17 PM, Eric Pancer <epancer at pobox.com> wrote:
> 
> Thanks, Carter! Okay, so we went with the following flexible Netflow
> configuration using standard v5 records but v9 as the exporter.
> 
> !
> flow exporter flow-export-west
> destination 172.18.86.50
> source GigabitEthernet0/0/1
> transport udp 2055
> !
> !
> flow monitor flow-monitor-west
> exporter flow-exporter-west
> record netflow-original
> !
> 
> By the way, just for the archive: turns out the Cisco ISR 4000-series
> cannot send flow data via the management interface/management VRF.
> Would have hoped this could have been separated out, but it just
> didn't work out.
> 
> Cheers!
> 
> - Eric
> 
>> On Fri, Jul 10, 2015 at 9:36 AM, Carter Bullard <carter at qosient.com> wrote:
>> Hey Eric,
>> Long time-no-read !!   Argus-clients-3.0.8 should read netflow v5 and v9, but v9 is always subject to further testing, as some of the data is pretty weird, like using a template that has ports in it for traffic that is not TCP or UDP.   Give it a try with V9, if you need the data ... V5 should be solid.
>> 
>> If anything comes up don't hesitate to holler ...
>> Hope all is most excellent,
>> Carter
>> 
>>> On Jul 10, 2015, at 9:01 AM, Eric Pancer <epancer at pobox.com> wrote:
>>> 
>>> Greetings,
>>> 
>>> It's been a good bit of time since I've been on a Cisco device to
>>> configure netflow and I see IOS15 has changed the command set. What's
>>> the best recommend you folks have for enabling netflow on a late model
>>> router so that they can be read by Argus? Is v9 supported fully yet or
>>> should I stick with v5?
>>> 
>>> These commands are what I came up with:
>>> 
>>> !
>>> flow exporter NETFLOW
>>> description Hello Carter!
>>> destination 10.1.1.25
>>> export-protocol netflow-v5
>>> ttl 15
>>> !
>>> 
>>> Of course I'm still running into a few other issues with getting this
>>> applied to an interface (including needing to have a valid flow
>>> record), so any tips are appreciated.
>>> 
>>> Thanks,
>>> 
>>> - Eric
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20151106/60cdd8ef/attachment.html>