Enable netflow statistics on a Cisco router: Difference between revisions

From wiki.comcert.com
Jump to navigation Jump to search
VisualWikitext
(Created page with " <span style="font-family:verdana,geneva,sans-serif;"><span style="font-size:large;">Introduction</span></span> <span style="font-family:verdana,geneva,sans-serif;">OptiView...")
 
No edit summary
 
(35 intermediate revisions by the same user not shown)
Line 1: Line 1:


<span style="font-family:verdana,geneva,sans-serif;"><span style="font-size:large;">Introduction</span></span>
== Introduction ==


<span style="font-family:verdana,geneva,sans-serif;">OptiView XG is NOT a NetFlow collector, but it is possible to querry CISCO routers for network flow bases statistcal analysis (top-n counters). &nbsp;The data is&nbsp;similar&nbsp;to what was obtainable by RMON . &nbsp;The data will be&nbsp;available under the tab in Device Details or in Application Infrastrcture Tests. &nbsp;In order to do so, the router first must be configured correctly.</span>
{{#invoke:Message box|ambox |type=notice|text=This TruView feature is only supported on Cisco routers.}}


<span style="font-family:verdana,geneva,sans-serif;"><span style="font-size:large;">Solution</span><br/> This example has been tested with a CISCO router model 1911 running IOS version 15. &nbsp;For more information about the commands used in this script, contact you CISCO partner. &nbsp;<br/> At this time, we consider that SNMP read-only access to the router has already been established and the community has sufficient view rights.</span>
OptiView XG is NOT a NetFlow collector, but it is possible to have OptiView poll a Cisco router for IP flow based network statistics. The results (top-n) are available on the OptiView under Device Details or in Application Infrastrcture Tests. In order to do this, routers in your network must be configured correctly.


<span style="font-size:medium;"><span style="font-family:verdana,geneva,sans-serif;">Global Configuration Mode</span></span>
&nbsp;


<span style="font-family:verdana,geneva,sans-serif;">Add the following commands to the global configuration section of the router:&nbsp;</span>
&nbsp;


<span style="font-family:verdana,geneva,sans-serif;"><WRAP center round info 98%><br/> In our case, the source and destination addresses of the flow exports are not important, but you need to enable flow exports in order to populate the flow top-talker list.&nbsp;<br/> </WRAP></span>
== Solution ==


<span style="font-family:verdana,geneva,sans-serif;">&nbsp; * conf t<br/> &nbsp; * ip flow-cache timeout active 1<br/> &nbsp; * ip flow-cache timeout inactive 14<br/> &nbsp; * ip flow-export source GigabitEthernet0/1<br/> &nbsp; * ip flow-export version 9<br/> &nbsp; * ip flow-export destination 1.1.1.1 2055<br/> &nbsp; * ip flow-top-talkers<br/> &nbsp; * top 100<br/> &nbsp; * sort-by bytes<br/> &nbsp; * cache-timeout 300000<br/> &nbsp; * exit<br/> &nbsp; * wr mem</span>
This configuration example has been tested with a CISCO router model 1911 running IOS version 15. For more information about the commands used in this script, read the router's IOS specific manual. We consider SNMP read-only access to the router already being properly configured and the community has sufficient view rights on the relevant MIBs.


<span style="font-family:verdana,geneva,sans-serif;">\\<br/> ==== Interface configuration mode ====<br/> Add the following command to the interface configuration section of __all interfaces carrying traffic__. &nbsp;There are __at least two interfaces__ that carry traffic, one facing the network, one facing the site. &nbsp;These may be physical interfaces or virtual interfaces like a sub-interfaces, dialers or tunnel interfaces. &nbsp;</span>
=== Global Configuration Mode ===


<span style="font-family:verdana,geneva,sans-serif;">&nbsp; * conf t<br/> &nbsp; * interface <interface name><br/> &nbsp; * ip flow egress<br/> &nbsp; * exit<br/> &nbsp; * wr mem</span>
You must enable flow exports in order to get the top counter tables populated.


<span style="font-family:verdana,geneva,sans-serif;"><WRAP center round info 98%><br/> This is a general applicable but not the only way for enabling NetFlow exports per interface. &nbsp;Please read your CISCO documentation for more information.<br/> </WRAP></span>
Enter Global Configuration Mode on the router and add the following commands to the configuration. Substitute <SourceInterface> and <DestinationAddress> with the appropriate values.


<span style="font-family:verdana,geneva,sans-serif;">\\<br/> ==== Debugging ====<br/> &nbsp; * Use the IOS command ''sh ip flow export'' and check if any flows are exported.<br/> &nbsp; * Use the IOS command ''sh ip flow top-talkers'' and check if the top-talker list is populated.</span>
conf t
ip flow-cache timeout active 1
ip flow-cache timeout inactive 14
ip flow-export source <SourceInterface>
ip flow-export version 9
ip flow-export destination <DestinationAddress> 2055
ip flow-top-talkers  
top 100
sort-by bytes
cache-timeout 300000
exit
exit
ip flow-top-applications
top 100
sort-by bytes
cache-timeout 300000
exit
wr mem


<span style="font-family:verdana,geneva,sans-serif;">----</span>
=== Interface Configuration Mode ===


<span style="font-family:verdana,geneva,sans-serif;">//Your feedback on this article is greatly appreciated - Please send feedback to <wiki@comcert.com>//</span>
This is a common yet not unique way to enable NetFlow exports for interfaces. Please read your router's IOS specific manual for more information on how to configure NetFlow on a per interface basis.


<br/> &nbsp;
Add the following command to the interface configuration section of all interfaces carrying traffic. There are at least two interfaces that carry traffic, one facing the network and one facing the site. These can be physical or virtual interfaces like sub -, dialer - and tunnel interfaces.
 
conf t
interface <InterfaceName>
ip flow egress
exit
wr mem
 
=== Debug ===
 
Still in priviledges mode, use the following commands to verify flow exports and population of the top counters
 
sh ip flow export
sh ip flow top-talkers
sh ip flow top-applications

Latest revision as of 10:22, 22 October 2016

Introduction

OptiView XG is NOT a NetFlow collector, but it is possible to have OptiView poll a Cisco router for IP flow based network statistics. The results (top-n) are available on the OptiView under Device Details or in Application Infrastrcture Tests. In order to do this, routers in your network must be configured correctly.

 

 

Solution

This configuration example has been tested with a CISCO router model 1911 running IOS version 15. For more information about the commands used in this script, read the router's IOS specific manual. We consider SNMP read-only access to the router already being properly configured and the community has sufficient view rights on the relevant MIBs.

Global Configuration Mode

You must enable flow exports in order to get the top counter tables populated.

Enter Global Configuration Mode on the router and add the following commands to the configuration. Substitute <SourceInterface> and <DestinationAddress> with the appropriate values. 

conf t
ip flow-cache timeout active 1
ip flow-cache timeout inactive 14
ip flow-export source <SourceInterface>
ip flow-export version 9
ip flow-export destination <DestinationAddress> 2055
ip flow-top-talkers 
top 100
sort-by bytes
cache-timeout 300000
exit
exit
ip flow-top-applications
top 100 
sort-by bytes 
cache-timeout 300000 
exit 
wr mem

Interface Configuration Mode

This is a common yet not unique way to enable NetFlow exports for interfaces. Please read your router's IOS specific manual for more information on how to configure NetFlow on a per interface basis.

Add the following command to the interface configuration section of all interfaces carrying traffic. There are at least two interfaces that carry traffic, one facing the network and one facing the site. These can be physical or virtual interfaces like sub -, dialer - and tunnel interfaces. 

conf t
interface <InterfaceName>
ip flow egress
exit 
wr mem

Debug

Still in priviledges mode, use the following commands to verify flow exports and population of the top counters 

sh ip flow export
sh ip flow top-talkers
sh ip flow top-applications
Retrieved from "https://wiki.comcert.com/index.php?title=Enable_netflow_statistics_on_a_Cisco_router&oldid=519"