NetFLow config for Cisco Nexus NXOS devices?

Question

I had a netflow config on my Nexus 7004's on NXOS that worked with Scrutinizer, but it not sending templates I guess to LM so it will not see them.
	&nbsp;

flow timeout active 120
flow timeout inactive 32
flow timeout fast 32 threshold 100
flow timeout session
flow timeout aggressive threshold 75
flow exporter Scrutinizer
  destination 10.35.148.221
  transport udp 2055
  source loopback0
  version 9
    template data timeout 0
    option exporter-stats timeout 1800
    option arp-table timeout 1800
    option sampler-table timeout 900
sampler Scrutinizer-Sampler
  mode 1 out-of 1
flow monitor Scrutinizer_monitor
  record netflow-original
  exporter Scrutinizer

I checked that the source of my flows is the same as the monitored IP in LM. I did a tcpdump to check that the flows are bursting to the collector I chose (dedicated to NetFlow)
	Does anyone have a working Nexus NetFLow with LM I can see your config?

&nbsp;

mnagel · Answer

The only NX-OS flow data we have functioning is via sflow not netflow, but both ought to work.&nbsp; Unfortunately, the documentation is a bit limited -- improved since the old days, but there is only one example -- the very popular and modern Cisco 3745 router with original Netflow.&nbsp; LM should have a maintained library of examples.

Regardless, the required field list is there (assuming the documentation is accurate).&nbsp; If you can't define a suitable record, get a capture and open a support case with LM to find out what changes to the record are needed to make it work.

mnagel · Answer

7 minutes ago, mnagel said:

The only NX-OS flow data we have functioning is via sflow not netflow, but both ought to work.&nbsp; Unfortunately, the documentation is a bit limited -- improved since the old days, but there is only one example -- the very popular and modern Cisco 3745 router with original Netflow.&nbsp; LM should have a maintained library of examples.

Regardless, the required field list is there (assuming the documentation is accurate).&nbsp; If you can't define a suitable record, get a capture and open a support case with LM to find out what changes to the record are needed to make it work.

One more item to check -- you said you saw the flows arriving via capture, but that will show with or without a local firewall.&nbsp; Please be sure you have opened access to the listener port if you have a local firewall active.

nick_ellson · Answer

6 minutes ago, mnagel said:

One more item to check -- you said you saw the flows arriving via capture, but that will show with or without a local firewall.&nbsp; Please be sure you have opened access to the listener port if you have a local firewall active.

I do have two 4451's sending flows successfully... so no firewalls. ?

nick_ellson · Answer

16 minutes ago, mnagel said:

The only NX-OS flow data we have functioning is via sflow not netflow, but both ought to work.&nbsp; Unfortunately, the documentation is a bit limited -- improved since the old days, but there is only one example -- the very popular and modern Cisco 3745 router with original Netflow.&nbsp; LM should have a maintained library of examples.

Regardless, the required field list is there (assuming the documentation is accurate).&nbsp; If you can't define a suitable record, get a capture and open a support case with LM to find out what changes to the record are needed to make it work.

Yeah, that one surprised me too. The TAC seemed to have no ready examples available. I do have a ticket open for this now.
	It was showing in the debug console as data coming in, but no templates showing up.
	$ !netflow func=listdevices
	ID &nbsp; &nbsp; &nbsp; &nbsp;Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Interface Indx &nbsp;IP Addresses &nbsp;
	======== &nbsp;=================== &nbsp;============== &nbsp;======================== &nbsp;
	11653 &nbsp; &nbsp; 10.35.253.6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.0.0.6, 10.35.0.174, 10.0.0.18, 10.35.252.2, 10.35.253.6, 10.36.0.13, 10.35.0.97, 10.35.0.105, 10.35.0.110, 10.35.0.74, 10.35.0.81, 10.35.0.89&nbsp;
	11984 &nbsp; &nbsp; 10.35.254.33 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 10.35.254.33, 38.32.89.58, 204.48.44.3, 204.48.45.3&nbsp; &lt;- non working 4451 that has to use a VRF for management.. prolly my bad.
	11655 &nbsp; &nbsp; 10.35.253.5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.0.0.2, 10.35.0.170, 10.35.252.1, 10.35.253.5, 10.36.0.9, 10.35.0.109, 10.35.0.73, 10.35.0.77, 10.35.0.85, 10.35.0.93 &lt;- nexus 7004
	11987 &nbsp; &nbsp; 10.35.253.2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;9,4,1,2,0 &nbsp; &nbsp; &nbsp; 10.35.0.169, 10.35.0.173, 10.35.252.3, 10.35.253.2, 10.78.7.173 &lt;- Working 4451
	11985 &nbsp; &nbsp; 10.35.253.1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;3,1,0,2 &nbsp; &nbsp; &nbsp; &nbsp; 204.48.44.50, 204.48.44.55, 10.35.253.1, 10.35.252.5, 192.168.7.5, 204.48.44.14, 10.35.0.86, 10.35.0.90 &lt;- working 4451&nbsp;
	11991 &nbsp; &nbsp; 10.35.253.9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.35.253.9, 10.35.0.98, 10.1.15.253, 10.35.0.94&nbsp;
	11981 &nbsp; &nbsp; 10.35.254.32 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 10.35.254.32, 50.218.62.74, 204.48.44.1, 204.48.45.1, 204.48.44.2, 204.48.45.2 &lt;- non working 4451 that has to use a VRF for management.. prolly my bad.

mnagel · Answer

12 minutes ago, Nick Ellson said:

Yeah, that one surprised me too. The TAC seemed to have no ready examples available. I do have a ticket open for this now.
			It was showing in the debug console as data coming in, but no templates showing up.
			11981 &nbsp; &nbsp; 10.35.254.32 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 10.35.254.32, 50.218.62.74, 204.48.44.1, 204.48.45.1, 204.48.44.2, 204.48.45.2 &lt;- non working 4451 that has to use a VRF for management.. prolly my bad.

IME, IOS-XE does not permit Netflow to be sourced from Mgmt-Intf, but perhaps this has been relaxed in later releases.&nbsp;

For the Nexus7K, if the netflow-original record lacks even one expected field (which seems hard to believe), it just silently fails. You might find some evidence in wrapper.log as to why but I have not generally had luck with that.&nbsp; You might take a look at alternate vendors that do maintain examples for other ideas -- one is https://support.solarwinds.com/SuccessCenter/s/article/Example-Nexus-7000-Config-flexible-v9-specific?language=en_US

Forum Discussion

NetFLow config for Cisco Nexus NXOS devices?

7 Replies

Related Content

Config Backup Reports

Network Device latency Report

Network Devices IOS Config Backup

New Widget display Dead Devices

Flexible Netflow help

Recent Discussions

Availability Group- multi-subnet Listener

Logic Monitor Collector Installation- Prompt for proxy address and port

Network Interface ID Persistence or: How I Learned to Stop Worrying and Love SNMP_Network_Interfaces

API documentation error

SNMP Monitoring for Windows