Changes between Version 7 and Version 8 of netmon2017netflow

Timestamp:

Nov 20, 2017, 10:10:08 AM (7 years ago)

Author:

admin

Comment:

--

netmon2017netflow

@@ -25 +25 @@
 == Router Configuration ==
 
+'''Note: This part is already done for you.'''
+
+=== Cisco Router ===
+
+Let's configure netflow on a cisco router
+ - Log in to the router and go to configuration mode
+{{{
+Router>enable
+Password: 
+#configure terminal
+Router(config)#
+}}}
+
+ - Create an exporter profile with the IP Address of the server where you have configure the nfdump and the transport port.
+{{{
+flow exporter EXPORTER-1
+ description Export to nfdump
+ destination <IP Address>
+ transport udp <port>
+ template data timeout 60
+}}}
+
+ - Define the flow monitor for IPv4 and call the created exporter. 
+{{{
+flow monitor FLOW-MONITOR-V4
+ exporter EXPORTER-1
+ record netflow ipv4 original-input
+ cache timeout active 300
+}}}
+
+ - Define the flow monitor for IPv6 and call the created exporter.
+{{{
+flow monitor FLOW-MONITOR-V6
+ exporter EXPORTER-1
+ record netflow ipv6 original-input
+ cache timeout active 300
+}}}
+
+ - Add the moniter profile to the Interface that export the flows
+{{{
+interface FastEthernet 0/0
+ ip flow monitor FLOW-MONITOR-V4 input
+ ip flow monitor FLOW-MONITOR-V4 output
+  ipv6 flow monitor FLOW-MONITOR-V6 input
+  ipv6 flow monitor FLOW-MONITOR-V6 output
+}}}
+
+ - Save the configuration
+
+=== HP Router ===
+ 
+ - Login to the router and go to Configure mode
+{{{
+<Router>system-view
+[Router]
+}}}
+
+ - Create the sflow agent and sflow source IP. (Interface IP of the interface that export the flow)
+{{{
+sflow agent ip <IP Address>
+sflow source ip <IP Address>
+}}}
+
+ - Define the sflow collector with the nfdump server IP and transport port.
+{{{
+sflow collector 1 ip <IP Address> port <Port> description "Export to nfdump"
+}}}
+
+ - Call the sflow collector fromm the interface and define other parameters.
+{{{
+interface GigabitEthernet0/0
+ sflow flow collector 1
+ sflow sampling-rate 4000
+ sflow counter collector 1
+ sflow counter interval 120
+}}}
+
+ - Save the configuration
+
 == Testing nfcapd/sfcapd and nfdump ==
 If your institutes access router uses netflow you shloud use nfcapd. If it uses sflow you should use sfcapd. You can find your router's flow expoter from this [wiki:netmon2017flowtype table]