Configuring NetFlow (I love this feature)

Credits to the original Author..

CONFIGURING THE ROUTER

First on Cisco box enable Cisco Express Forwarding:

router(config)# ip cef
router(config)# ip cef distributed

and turn on flow accounting for each input interface with the interface command:

interface FastEthernet3
ip route-cache flow

interface Serial3/1
ip route-cache flow

...

Now, verify that the router (or switch) is generating flow stats. Try command 'show ip cache flow'. Note that for routers with distributed switching (GSR's, 75XX's) the RP cli will only show flows that made it up to the RP. To see flows on the individual linecards use the 'attach' or 'if-con' command and issue the 'sh ip ca fl' on each LC.

IP packet size distribution (36242M total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.002 .340 .084 .021 .020 .012 .009 .009 .008 .007 .006 .007 .004 .003 .004

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.002 .004 .035 .077 .338 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4456704 bytes
4139 active, 61397 inactive, 712344771 added
871670181 ager polls, 0 flow alloc failures
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 1572735 0.3 58 127 21.4 27.0 14.8
TCP-FTP 6193502 1.4 24 746 35.3 3.6 9.0
TCP-FTPD 1458042 0.3 1534 833 520.9 42.4 4.2
TCP-WWW 93403998 21.7 19 633 432.9 4.9 6.3
TCP-SMTP 16123540 3.7 15 431 59.1 3.4 6.4
TCP-X 687228 0.1 238 276 38.1 20.8 14.3
TCP-BGP 1116819 0.2 3 45 0.7 5.3 16.0
TCP-NNTP 1455156 0.3 1102 176 373.4 106.1 11.9
TCP-Frag 3244 0.0 4 636 0.0 2.8 16.3
TCP-other 188162587 43.8 118 733 5204.5 11.1 6.9
UDP-DNS 38042100 8.8 3 84 27.3 3.8 16.4
UDP-NTP 18760129 4.3 1 76 5.3 1.3 16.3
UDP-TFTP 665 0.0 4 76 0.0 7.9 16.4
UDP-Frag 13111 0.0 2121 1108 6.4 366.8 13.5
UDP-other 195556237 45.5 35 343 1632.5 5.8 16.3
ICMP 149285440 34.7 2 64 72.9 0.9 16.5
IGMP 15315 0.0 167 32 0.5 1660.6 3.9
IPINIP 15112 0.0 35 52 0.1 275.3 14.2
GRE 127489 0.0 3 109 0.1 16.9 16.1
IP-other 348604 0.0 56 447 4.5 21.5 16.2
Total: 712341053 165.8 50 620 8436.8 6.2 12.2

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
AT4/0.1 128.146.225.194 AT1/0.2 128.194.203.23 06 0019 2CAF 15
AT2/0.10 129.22.250.148 AT1/0.2 129.2.226.43 06 04BA 1A20 1266
AT2/0.11 130.108.110.48 AT1/0.2 170.140.89.100 06 0923 10A3 436
AT1/0.2 170.140.89.100 AT2/0.11 130.108.110.48 06 10A3 0923 462

! Enable the exports of flows with the global commands
router(config)# ip flow-export version 5 origin-as
router(config)# ip flow-export 10.0.0.2 2000

! Create a loopback interface if one does not exist
!
router(config)# interface Loopback0
ip address 10.0.0.1 255.255.255.255

!
! Configure NetFlow export source address
!
router(config)#ip flow-export source Loopback0

If you have tcpdump installed on or near the host you're using to capture flows, the exports can be verified.

netflow:~# tcpdump -n udp port 2000
tcpdump: listening on eth0
12:11:29.953100 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:29.962551 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:29.975115 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:29.984444 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:29.993956 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:30.003252 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:30.015483 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:30.024852 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:30.034182 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:30.043545 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168
12:11:30.053239 10.0.0.1.1868 > 10.0.0.2.2000: udp 1168

SETTING UP NETFLOW COLLECTOR

After installation of NetFlow Collector, edit file /etc/netflow/nfc.conf In this file you can specify, NetFlow Collector Unit Id, this id must correspond with id created by NetFlow Web tool (see installation of NetFlow Web and installation of mysql database). This id is unique for one computing unit ~ one computer. In one unit can run more collectors (one collector ~ at least one netflow export source / router). Unit ID is under section [Main]. In config file there's another section [Database]. You can specify, database name (default nf), hostname (default localhost), username (default root), password, etc ... If you run all-in-one (NetFlow Collector, NetFlow Web and database in one box, you needn't modify anything in the file /etc/netflow/nfc.conf All other parameters are setup by web interface ...
Now, it is all, you can try run collector by typing

netflow:~#/etc/init.d/nfc start


Now it's good time to check syslog for any errors ...

netflow:~#less /var/log/syslog

Auto-MDIX dilemma

Configuring Auto-MDIX on an Interface
"When automatic medium-dependent interface crossover (auto-MDIX) is enabled on an interface, the interface automatically detects the required cable connection type (straight through or crossover) and configures the connection appropriately. When connecting switches without the auto-MDIX feature, you must use straight-through cables to connect to devices such as servers, workstations, or routers and crossover cables to connect to other switches or repeaters. With auto-MDIX enabled, you can use either type of cable to connect to other devices, and the interface automatically corrects for any incorrect cabling. For more information about cabling requirements, see the hardware installation guide.

Auto-MDIX is enabled by default. When you enable auto-MDIX, you must also set the interface speed and duplex to auto so that the feature operates correctly. Auto-MDIX is supported on all 10/100 and 10/100/1000-Mbps interfaces and on 10/100/1000BASE-TX small form-factor pluggable (SFP)-module interfaces. It is not supported on 1000BASE-SX or -LX SFP module interfaces."

So you can use a straight through cable to connect two switches, but you then cannot explicitly set the speed and duplex.

"To be fair, I wasn’t aware of the auto-MDIX needing auto-negotiation issue, BUT whenever you are troubleshooting a problem you want to minimize any deviations from known working configurations to eliminate unnecessary variables. I think that I remember reading that auto-MDIX uses the same protocol as auto-negotiation and that’s why both need to be enabled. I’m not positive about that though."

Assume that “correct cabling” means a cross-over cable and “incorrect cabling” means a straight-through cable.

Local Side Auto-MDIX	Remote Side Auto-MDIX	With Correct Cabling	With Incorrect Cabling
On	On	Link up	Link up
On	Off	Link up	Link up
Off	On	Link up	Link up
Off	Off	Link up	Link down

You can refer to the table below, but it’s pretty easy to determine if a link will be up or not: at least one side needs to have auto-MDIX enabled along with auto-negotiation of speed and duplex, otherwise the link will be down.

sw1		sw2
MDIX	Speed/Duplex	MDIX	Speed/Duplex	Link Status
on	auto	on	auto	up
on	auto	on	hard-set	up
on	auto	off	auto	up
on	auto	off	hard-set	up
on	hard-set	on	auto	up
on	hard-set	on	hard-set	down
on	hard-set	off	auto	down
on	hard-set	off	hard-set	down
off	auto	on	auto	up
off	auto	on	hard-set	down
off	auto	off	auto	down
off	auto	off	hard-set	down
off	hard-set	on	auto	up
off	hard-set	on	hard-set	down
off	hard-set	off	auto	up
off	hard-set	off	hard-set	down

This makes sense because you need at least one side to be able to logically switch the pinouts of a straight-through cable to emulate a cross-over cable. Hard-setting the speed or duplex disables the auto-negotiation protocol (which auto-MDIX must utilize as well) which effectively disables auto-MDIX:

Note: The only command that I know of that will show the auto-MDIX state of an interface (other than looking at the running-configuration of the interface) is the rather verbose “show controllers ethernet-controller fax/x phy | include MDIX” command.

Note: The default setting for switch ports is to have auto-MDIX enabled. This is a pretty recent change though. IOS versions prior to 12.2(20)SE will use the default of “no mdix auto”.

“mdix auto” is the default, so it does not show in the running-configuration:
sw2(config)#do sh run int fa0/32
Building configuration…
Current configuration : 34 bytes
!
interface FastEthernet0/32
end

We can verify that auto-MDIX is on for this interface:
sw2(config)#do sh controll eth fa0/32 phy | i MD
Auto-MDIX : On [AdminState=1 Flags=0x00052248]

Let’s hard-set the speed and see what happens to auto-MDIX:
sw2(config)#int fa0/32
sw2(config-if)#speed 100
sw2(config-if)#do sh control eth fa0/32 phy | i MD
Auto-MDIX : Off [AdminState=1 Flags=0x00010A48]

Notice that our configuration does not state that auto-MDIX has been disabled:
sw2(config-if)#do sh run int fa0/32
Building configuration…

Current configuration : 45 bytes
!
interface FastEthernet0/32
speed 100
end

This verifies that hard-setting the speed and/or duplex turns off auto-MDIX for the interface.

Note: I did test to see if DTP was effected by auto-MDIX. It was not. As long as the link was up, DTP could work it’s trunking magic.

So the long and the short of it is: you can use straight-through cables to connect two Cisco switches as long as you are willing to sacrifice the ability to hard-set the speed and/or duplex on both sides of the link.

Surprisingly i tested above commands on a 2950 and a 3550-SMI switches, i could not get any info regarding auto-mdix.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_25_see/configuration/guide/swint.html

Polycom soundstation2 and Nortel Meridien option 11c

Apparently when Nortel Meridien 11c PBX is hooked with one of the new DLC cards i.e, 16 port or 48 port,the soundstation2
seems to hang up when initializing, there are couple of solutions to this issue;

(1)Download the latest firmware, this step is mandatory, the old firmware has some issues with latest DLC Crads and sound station2 integration.

(2)As per Polycom's recommendations use M2616 Configuration for soundstation2.

(3)Polycom's documentation:
"SoundStation2 Direct Connect is compatible with any digital voice port on NORTEL® Meridian®, Meridian 1 (option 11 to 81), SL-1, or SL-100 PBX with the exception of those supporting MBS (CENTREX®) phone sets. In addition to the basic product functions, it supports two special functions - Conference and Transfer - in the same manner as the default M2616 Model 20, using key number position 3 for Conference and key number position 6 for Transfer. Contact your PBX Administrator to confirm that the Conference and Transfer functions at the port are assigned to these key number positions."

(4)A forum stated the same issue, one of the guy responded'
"I have been in touch with Polycom support (an on-line support system, no TELEPHONE support - how ironic). They have stated that "The SoundStation2 Nortel will emulate a M2009 set if there is no digital telephone set attached to the interface."

(5)You can try this,
"Carl, do you have a 2616 to test with? Start with the basics. See if the port will work with a 2616, if you have one. If you don't have a 2616, plug in a 3903 or 3904 and you should still be able to get dial-tone."

I read on another forum, that there are dip switches you need to set, in order for the unit to work correctly (Not specific to your issue, but I would set them ahead of time).

The separate box where all the cables and power goes turn it upside down, by the Polycom logo on the serial number sticker there will be a tiny square overlay sticker, peel it back and it will reveal 3 jumper switches, from memory turn number 3 off
1 = on
2 = on
3 = off

you can try this if you want to,

Configure your TN 6-12 as a TYPE 3904 (instead of 2616 as they suggest in the user guide), then use the supplied connectors and an M3904 set. Reason I would try this is that as per above printed info, they want you to use an appropriate Nortel phone in line with the unit. Since you don't have a 2616 phone, may be you can get away with M3904. That way the PBX will at least have the correct phone type matched to the TN, and I doubt that the Soundstation will know the difference, as long as your conf / trn keys are as per user guide.

Second thing to try is to configure your TN 6-12 as an TYPE 2009 (this is before my time, so not sure that you can just enter this type), then connect the sound station directly to the voice point, meaning you are then using their suggested method.

References, credit to original authors

Ploycom KB

http://www.polycom.com/support/voice/soundstation/soundstation2.html

PBX-Info

http://www.pbxinfo.com/forums/showthread.php?t=35075

Nortel KB

http://support.nortel.com/go/main.jsp?cscat=DOCUMENTATION&poid=8310&catOID=-9602&viewOptSelect=&viewOpt1=&viewOpt2=DEFAULT&searchText=&searchType=fulltext&x=43&y=3