Let's see how we Export Netflow from Cisco Switches to Solarwinds Netflow:
- Create Flow Record
- Create Flow Exporter
- Create Flow Monitor
- Apply flow monitor to interfaces
Example for Cisco Catalyst 9200/9300 devices
This setup will also solve the following error Solarwinds gives when exporting netflow from Cat9200/9300:
"The NetFlow Receiver Service [Solarwinds-Host] received an invalid V9 template with ID 256 from device . See knowledge base for more information."
Then you must do a similar configuration to the following:
flow record NETFLOW_INPUT_RECORD
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match flow direction
match interface input
collect counter bytes long
collect counter packets long
!
flow record NETFLOW_OUTPUT_RECORD
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match flow direction
match interface output
collect counter bytes long
collect counter packets long
!
flow exporter NETFLOW_EXPORTER
destination <ip_address_of_Solarwinds_server>
source <your_source_interface_for_netflow_traffic>
transport udp 2055
!
flow monitor NETFLOW_MONITOR_OUTPUT
exporter NETFLOW_EXPORTER
record NETFLOW_OUTPUT_RECORD
!
flow monitor NETFLOW_MONITOR_INPUT
exporter NETFLOW_EXPORTER
record NETFLOW_INPUT_RECORD
!
sampler NETFLOW_SAMPLER
mode random 1 out-of 2
!
interface <the_interface_which_you_want_to_export_netflow_of>
ip flow monitor NETFLOW_MONITOR_INPUT sampler NETFLOW_SAMPLER input
ip flow monitor NETFLOW_MONITOR_OUTPUT sampler NETFLOW_SAMPLER output
!
NOTES:
If you have NBAR:
#collect application name
If you use BGP:
#collect routing source as
#collect routing destination as
Some Other Links:
https://community.cisco.com/t5/switching/netflow-v-s-netflow-lite/td-p/1892027
Netflow Lite
Only with nprobe: https://www.ntop.org/products/netflow/nprobe/
Project: https://www.plixer.com/blog/netflow/catalyst-4948e-netflow-lite-exports/
Scrutinizer, analyzer: https://www.plixer.com/products/scrutinizer/
Netflow Lite
Only with nprobe: https://www.ntop.org/products/netflow/nprobe/
Project: https://www.plixer.com/blog/netflow/catalyst-4948e-netflow-lite-exports/
Scrutinizer, analyzer: https://www.plixer.com/products/scrutinizer/