Enabling Net Flow on a Catalyst 6500
The Catalyst 6500 separates the data collection configuration from the NetFlow data export (NDE) to collectors.
Example 15-1 shows a basic configuration of NetFlow on Cisco IOS.
NOTE The NetFlow configuration contains more options, such as allowing the supervisor the ability to build a flow cache entry for switched frames (that is, not only for routed ones).
Example 15-1 Configuring NetFlow on Catalyst 6500 and Cisco IOS
IOS(config)# mls netflow
IOS(config)# mls flow ip interface-full
IOS(config)# mls flow ipv6 interface-full
IOS(config)# mls nde sender version 7
IOS(config)# ip flow-export source vlan 1
IOS(config)# ip flow-export destination 10.10.10.100 200
In Example 15-1, NetFlow data is entered with the interface-full flow mask; that is, one entry for every flow identified by the 6-tuple <source interface, source IP address, destination IP address, IP protocol, source Layer 4 port, destination Layer 4 ports>. This setting provides the more granular information, because no aggregation of multiple flows is done; hence, all the per flow information is exported. This setting must be used when NetFlow is deployed for security.
In Example 15-1, NetFlow has also been enabled for both IPv4 and IPv6. The specific export of flows is version 7, and the NetFlow collector is on address 10.10.10.100 on UDP port 200. All NetFlow datagrams are sent from interface VLAN 1.
After NetFlow is enabled, Example 15-2 shows an example of the local NetFlow cache dump. (This example shows only five flows.)
Example 15-2 NetFlow Cache Content
|
IOS# sh mls |
netflow ip |
||||||
|
Displaying |
NetFlow entries in Supervisor |
Earl |
|||||
|
DstIP |
SrcIP |
Prot:SrcPort:DstPort Src i/f |
:AdjPtr |
||||
|
Pkts |
Bytes Age |
LastSeen |
Attributes |
||||
|
10.48.82 |
69 |
171.69.100.133 |
udp :ntp |
:ntp |
V1822 |
:0x0 |
|
|
0 |
0 |
130 |
14:19:09 |
L3 - |
Dynamic |
||
|
10.48.82 |
69 |
144.254.4.174 |
tcp :4374 |
:telnet V1822 |
:0x0 |
||
|
0 |
0 |
147 |
14:21:19 |
L3 - |
Dynamic |
||
|
10.48.82 |
69 |
10.48.82.65 |
icmp:0 |
:0 |
V1822 |
:0x0 |
|
|
0 |
0 |
1703 |
14:21:16 |
L3 - |
Dynamic |
||
|
172.24.251. |
100 |
172.24.239.72 |
47 :0 |
:0 |
V1822 |
:0x0 |
|
|
0 |
0 |
72 |
14:20:07 |
L3 - |
Dynamic |
||
|
10.48.82 |
69 |
10.48.82.100 |
icmp:0 |
:0 |
V1822 |
:0x0 |
|
|
0 |
0 |
197 |
14:21:10 |
L3 - |
Dynamic |
||
In Example 15-2, the Catalyst has not collected the MAC addresses because, at the time of writing this book, MAC addresses were not yet collected in the NetFlow cache by that version of the Cisco IOS.
Continue reading here: Increasing Security with Net Flow Applications
Was this article helpful?