NetFlow Appliance setup

Our collector requires a dedicated appliance, for the trial please use the following ova to deploy a dedicated VM; "https://www.mutiny.com/support/downloads/MutinyV5N.ova"

You will need to ensure that when it is deployed it has a dedicated NIC. This is because NetFlow traffic can have a severe impact on the network and should be switched away from any shared services. It works best if you can follow the basic network diagram below:

Once you have successfully deployed this OVA, use vcentre/vsphere  to connect to the Console and set the static IP address you have allocated, the network mask and default gateway.

You should then be able to connect to it using a Web browser and login as "superadmin@mutiny.com/password". The licence will have expired, so select [Admin]=>"System" and paste in a new licence (request a licence from support@mutiny.com). You can then logoff from the NetFlow collector and you should never need to log onto it again. DO NOT upgrade the NetFlow collector unless requested directly by support@mutiny.com.

Next, log on to your main Mutiny system and again head for [Admin]=>"System". Save your existing liceince text to a file on your PC and paste in the tempory licence you requested earlier. Near the top, you should see a box marked "Remote NetFlow Collector address" .  Enter the IP address that you have given to the NetFlow collector in this box and then click [Update] at the bottom of the page.

Next select [Module]="NetFlow" and check that you can connect to the NetFlow Database on the Collector.

To configure the devices to send NetFlow to the Collector, please see this guide on our Website: https://www.mutiny.com/mutiny-support/netflow-setup/

Once the devices are sending NetFlow, data you will be able to view it in a pie chart and drill down into the flows.

NetFlow Probe setup

Before Mutiny can display flow data in your NetFlow tab you will need to have some additional configuration in your router.

For a basic setup you need to add the following to your Cisco (NetFlow supported) device;

-----Cut Here----
!

ip flow-export version 5

ip flow-export destination your.mutiny.add 2055

ip flow-top-talkers

 top 10

 sort-by bytes

!
----cut here---- 

Then for each interface you want flows from, add the line

ip route-cache flow

 

eg.

!

interface Vlan3

 description Demo_DMZ$FW_DMZ$

 ip address 192.168.99.1 255.255.255.0

 ip access-group 103 in

 no ip redirects

 no ip unreachables

 no ip proxy-arp

 ip nat inside

 ip inspect sdm_ins_in_100 in

 ip inspect dmzinspect out

 ip virtual-reassembly

 ip route-cache flow

!

 

**Note, if the commands are not recognised then you version of ios does not support NetFlow

Also see the documents;

Introduction to Cisco IOS NetFlow
NetFlow Config Guide 

Comparison between NX-OS and IOS

Wikipedia entry for NetFlow

NetFlow tutorial