- Let's take a look at troubleshooting NetFlow version 5,
here you can see in our topology
that we have three hosts on the 10.1.1.0/24 network.
And they're connected into a router,
that takes us over to the 192.168.10.0/24 network,
where we can see our NetFlow Collector.
NetFlow gives us lots of insight into our network traffic,
so it's a very valuable tool,
it's very common, in fact,
it's actually a best practice to use
an external NetFlow Collector.
Now, you can use NetFlow to view information
directly in the command line interface.
But it's much better to use a standalone collector,
this is going to give you the ability
to store NetFlow information
for a much longer period of time.
And it's also going to give you
access to lots of helpful analytics and sorting tools
through a Netflow Collector software.
And this example, in this particular router,
router one that's configured to collect
and export NetFlow information
to an external NetFlow collector.
Let's say that our collector isn't receiving information,
we don't see our flow information
hitting our collection server.
So let's take a look at the places
where we would want to troubleshoot this.
First, we might want to verify that
the server is reachable from router one,
that would be a logical first step.
So let's do that with a simple ping to 192.168.10.5,
so that is successful.
We can take a look at our local cache in the CLI,
by saying show IP cache flow.
And you may notice that since this is a lab environment,
I actually don't have any outputs down here,
that's actually blank at the moment.
Now if this were a production environment,
you'd probably have lots of information here already,
but we can generate some traffic for that.
So let's do that.
I'm going to jump over to PC1,
and I'm going to ping the collection server,
just to generate some traffic,
so that is successful.
We'll go back to router one now,
run that same show command show IP cache flow.
And this time, we see some flow record information.
Now at the bottom, you can see
that we have a source interface of Gi0/1,
which is the interface point to our hosts,
we have a source IP address,
which you'll see correlates to the IP address
of PC1, 10.1.1.10.
The destination interface is Gi0/2
which is pointing to our NetFlow collection server
and the destination IP address is of course,
the IP address of the server itself.
Now notice that we have two entries here,
and that's because a flow is unidirectional,
you may remember that.
So these pings between the host and the collector,
they're creating two distinct flow records,
we have one with our source interface Gi0/1
that's going from PC1 to the collector
and we have one with a source interface Gi0/2
coming back from the collector and going back to our host,
so that's why we see those two records.
So let's dig a little bit deeper into this,
let's say show run pipe to include IP flow.
And in this output, we're all be able to see
that we have an IP flow export source we see that here
designated as GigabitEthernet0/1 and of course,
that's the interface connected out to our hosts,
we can also see that we have net flow version 5 configured.
So that's important to note,
we want to make sure that the version we're using
matches what we have on our NetFlow Collector
in order to receive that information, so that's good.
And we can see our IP flow export destination,
which is pointing to our NetFlow Collector
at 192.168.10.5
now, do you see a problem here?
That IP address is actually incorrect,
so that would be one reason why
we might not be getting flow information
on our server,
that is an incorrect IP address, so let's correct that.
Let's go under global configuration mode,
and let's say no IP flow-hyphen export.
We want to say destination,
and we want to say 192.168.10.50,
which is actually the
line that we have in there, that's incorrect
and we'll follow that with Port 5000.
We want to take that line out of our configuration.
And now we want to put it back in
with the correct IP address.
So let's say IP flow-export destination
192.168.10. 5, we use the same port number 5000.
So there we go, we have that back in place
and everything is correct, that's much better.
Let's break out of that
and let's use a couple more of our show commands,
let's say show IP flow interface,
this is going to show us the interfaces
configured to use NetFlow.
So for interface Gi0/1,
we see that this is set to both ingress and egress.
So that means this is going to capture
inbound and outbound traffic.
If you're seeing flow information that's missing
from a particular direction,
it's likely that you haven't configured
the interface capture directions properly.
So you can do that for a single direction,
or you can do that as we see here
for both directions,
we have both the ingress and egress commands listed here.
Again, remember, these flows are unidirectional,
so if you want to capture in both directions,
you want to configure the interface
for both egress and Ingress traffic, that's very important.
One more command to show you for troubleshooting,
let's say, Show IP flow export.
This is also going to allow us to verify
the version of NetFlow in use.
Again, we see that we are using version 5 flow records,
we can also see our source and destinations as well
listed here, our source is the IP address for
interface Gi0/1 of 10.1.1.1,
and the destination is our NetFlow Collection server
192.168.10.5 over Port 5000.
We also get a summary of how many flows have been exported,
we see two flows export it in one UDP datagrams
in my lab example,
and below that we would see evidence
of any export packet drops.
So that's a look at NetFlow version 5 troubleshooting.