NetFlow configuration on Catalyst 4500-X

At long last, an answer. I recently encountered another situation where I had to create access-lists that would benefit from object-group references. After trying several different things to work around the problem, I finally threw in the towel and contacted Cisco technical support (which I'm always loath to do).

After an initial careless and blatantly wrong attempt to answer my question, the Cisco technician came back with the following:

Matthew,

I have reached out to the development team and object group configuration with the 4500 platform does not work as desired given the fact that the feature is not fully supported until code version 15.2(3)E2 which will be released around August 2015.

It is possible for the ACL to be configured because they have the same IOS XE base as other devices that support the feature at this time.

So, there you go - and it only took Cisco 6 days to come up with this answer (a record).

Your Flow Monitor doesn't match your Flow Record or Flow Exporter. You have record NETFLOW and exporter NETFLOW. Try something like this:

flow monitor NETFLOW-MONITOR
 record NETFLOW-RECORD
 exporter NETFLOW-EXPORTER
 statistics packet protocol
 statistics packet size
 cache timeout active 60

You also don't need the old NetFlow commands on the interface, so you can remove:

 ip flow ingress
 ip flow egress

This is the way I have seen it work successfully, albeit only used on layer-3 interfaces, and only in one direction or the other:

flow record NETFLOW-RECORD
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 collect interface input
 collect interface output
 collect counter bytes
 collect counter packets
!
flow exporter NETFLOW-EXPORTER
 destination 10.10.10.12
 transport udp 2055
 source Vlan100
!
flow monitor NETFLOW-MONITOR
 record NETFLOW-RECORD
 exporter NETFLOW-EXPORTER
 cache timeout inactive 15
 cache timeout active 60
!

You can try it in both directions on a layer-2 interface, but I think your problem is the incorrect Flow Record and Flow Exporter in the Flow Monitor.

interface range GigabitEthernet 0/1-52
 ip flow monitor NETFLOW-MONITOR input
 ip flow monitor NETFLOW-MONITOR output
!

Edit:

This is from Configuring Flexible NetFlow:

NetFlow is supported only on the network services module. Only one flow monitor per interface and per direction is supported by the network services module.

As I understand it, you need IOS 15.x, and at least the IP Base license with the Network Services Module for Flexible NetFlow.

You are trying to apply it to non-module ports, G0/1-48, which doesn't work, anyway. It should only work on G0/49-52, but I'm not sure you can use it on the 3560 at all. I saw a note generated from Cisco TAC saying that this only works on a 3750X:

The netflow module is only available in the 3750x's. You're out of luck.

Sent from Cisco Technical Support Android App