催化剂4500-X上的NetFlow构型

Question

我在4500-X开关上配置NetFlow有问题.

这是NetFlow配置

flow record NFArecord
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input netflow
 match interface output netflow
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
!
!
flow exporter ELK
 destination 172.17.214.33
 transport udp 9966
!
!
flow monitor NFAmonitor
 exporter ELK
 cache timeout inactive 30
 cache entries 10000
 record NFArecord
!

我想收集内部vlan流量的记录。

试着这样做：

interface Port-channel2 
//this is port-channel to SW3750, want to collect ingress traffic on in interface
 description Trunk to 6floor
 switchport
 switchport mode trunk
 end

Core-4500x(config-if)#ip flow monitor NFAmonitor in
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

好的，尝试将ip流应用于vlan 60，结果是相同的：

Core-4500x(config-vlan-config)#ip flow monitor NFAmonitor input 
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

Core-4500x(config-vlan-config)#ip flow monitor NFAmonitor layer2-switched input 
% Flow Monitor: Flow Monitor 'NFAmonitor' - Incompatible traffic type: Record has Undetermined, monitor applied with IPv4

怎么了？我应该为NetFlow工作做些什么？

Answer 1

从您的错误来看，一些流记录似乎不能用于第三层流捕获。

试试这个配置。它将应用于桥梁水平。

flow record FLOW-RECORD-IPV4
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect interface output
 collect counter bytes long
 collect counter packets long

flow exporter FLOW-EXPORTER-X.X.X.X
 description FLOW-EXPORTER X.X.X.X
 destination X.X.X.X
 source VlanX
 transport udp 2055

flow monitor FLOW-MONITOR-IN
 description MONITOR INGRESS FLOWS
 record FLOW-RECORD-IPV4
 exporter FLOW-EXPORTER-X.X.X.X
 cache timeout inactive 60

vlan configuration 10,20,30,40,50,60
ip flow monitor FLOW-MONITOR-IN input

此外，您还可以在接口级别应用它：

interface GigabitEthernet1/3/1
 ip flow monitor FLOW-MONITOR-IN input