Netflow v9 - The collector has not reported any traffic flow health metrics for this device.
Summary: Bram Assendorp is experiencing issues with Netflow on Cisco equipment, despite proper configuration and visible device interfaces. They report that LogicMonitor (LM) is not processing information, although Netflow is enabled at the device level. Carsten Schmidt suggests checking if LM is ready for Netflow and whether the collector can handle it. Patrick Rouse mentions a related support case indicating the issue may have been resolved, inviting Bram Assendorp to reopen the case if it persists.
Anyone got Netflow working with Cisco equipment?
Got the following config:
flow record NETFLOW-RECORD-LM
description NetFlow record format to send to LM
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface input
match datalink mac source address input
match datalink mac destination address input
match ipv4 ttl
match ipv4 tos
collect interface output
collect timestamp sys-uptime first
collect timestamp sys-uptime last
collect flow direction
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last
flow exporter LM1
destination xxx.xxx.xxx.55
source TenGigabitEthernet0/1/1
transport udp 2055
template data timeout 60
flow monitor NETFLOW-MONITOR
exporter LM1
cache timeout active 60
record NETFLOW-RECORD-LM
interface gi0/0/4
ip flow monitor NETFLOW-MONITOR input
ip flow monitor NETFLOW-MONITOR output
interface TenGigabitEthernet0/1/1
ip address xxx.xxxx.xxx.131 255.255.255.248
negotiation auto
end
But still nothing in Logicmonitor, tested with Wireshark, and it does receive netflow on port 2055.
$ !netflow func=listdevices
ID Name Interface Indx IP Addresses
======== =================== ============== ========================
2626 xxx.xxx.xxx.167 xxx.xxx.xxx.131
And yes, netflow is enabled on device level, and interfaces are visible an other monitoring works great.
It just seems, LM is not processing any info.
Patrick Norris
·2 weeks agoWhat is the model of the Cisco equipment?
I'm doing netflow on a Cisco C9500 and this is the configs on it with working netflow to LM.
flow record NetflowIN
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface input
match ipv4 tos
match flow direction
collect interface output
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect timestamp absolute first
collect timestamp absolute last
!
!
flow record NetflowOut
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface output
match ipv4 tos
match flow direction
collect interface input
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect timestamp absolute first
collect timestamp absolute last
!
!
flow exporter NETFLOW-EXPORTER
destination XXX.XXX.XXX.17
transport udp 2055
template data timeout 90
!
!
flow monitor NetflowMonIN
exporter NETFLOW-EXPORTER
cache timeout active 60
record NetflowIN
!
!
flow monitor NetflowMonOut
exporter NETFLOW-EXPORTER
cache timeout active 60
record NetflowOut
Interface configs
ip flow monitor NetflowMonIN input
ip flow monitor NetflowMonOut output
Patrick Rouse
·2 weeks ago@Bram Assendorp according to the related support case, this appears to be resolved. Please reopen the case if the issue persists
Carsten Schmidt
·3 weeks ago · EditedIf the device in LM has "Enable Netflow analysis" activated, did you check whether the collector itself is capable of handling Netflow or whether the device has a netflow collector assigned?
Bram Assendorp
OP3 weeks agoanyone?