>конфигурацию в этом случае не плохо бы показать... Внешний интерфейс Eth0/0
Внутрение Eth0/1, Fast2/0
Статистика льется через внутренний Fast2/0
Помимо вышеуказанной проблемы есть еще одна, из этой же области. Не все, даже с двух сторон с реальными IP потоки выливаются в статистику (тоже при sh ip cache flow в DstInt стоит null), причем другой поток между этими IP может записаться. Ни в какие ACL (блокирующие) неучтенный поток не попадает.
Current configuration : 12674 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname cisco-3640
!
boot system flash c3640-io3-mz.122-32.bin
no logging console guaranteed
aaa new-model
!
ip subnet-zero
no ip rcmd domain-lookup
ip rcmd rsh-enable
ip flow-cache entries 4094
ip flow-cache timeout inactive 240
ip flow-cache timeout active 45
ip cef
!
!
ip audit notify log
ip audit po max-events 100
!
!
!
interface Loopback0
ip address 193.xxx.xxx.225 255.255.255.255
no ip unreachables
no ip proxy-arp
ip route-cache flow
no ip mroute-cache
no keepalive
!
interface Tunnel0
ip address 192.168.200.1 255.255.255.0
ip access-group 199 in
ip mtu 1470
ip nat inside
ip route-cache flow
no ip mroute-cache
tunnel source 172.16.1.1
tunnel destination 172.16.0.1
tunnel mode ipip
!
interface Ethernet0/0
ip address 172.16.1.1 255.255.255.0 secondary
ip address 195.xxx.xxx.66 255.255.255.192
ip access-group 199 in
no ip unreachables
no ip proxy-arp
ip nat outside
ip route-cache flow
no ip mroute-cache
ip policy route-map netflow_nat
no keepalive
half-duplex
no cdp enable
!
interface Serial0/0
no ip address
shutdown
!
interface Ethernet0/1
ip address 192.168.4.250 255.255.255.0 secondary
ip address 193.xxx.xxx.253 255.255.255.252 secondary
ip address 193.xxx.xxx.65 255.255.255.192
ip access-group 199 in
no ip unreachables
no ip proxy-arp
ip nat inside
rate-limit input access-group 115 96000 18000 36000 conform-action transmit exceed-action drop
rate-limit input access-group 117 256000 48000 96000 conform-action transmit exceed-action drop
rate-limit input access-group 119 64000 12000 24000 conform-action transmit exceed-action drop
rate-limit input access-group 121 96000 18000 36000 conform-action transmit exceed-action drop
rate-limit input access-group 123 96000 18000 36000 conform-action transmit exceed-action drop
rate-limit input access-group 125 96000 18000 36000 conform-action transmit exceed-action drop
rate-limit input access-group 127 96000 18000 36000 conform-action transmit exceed-action drop
rate-limit input access-group 129 64000 12000 24000 conform-action transmit exceed-action drop
rate-limit input access-group 131 64000 12000 24000 conform-action transmit exceed-action drop
rate-limit input access-group 135 64000 12000 24000 conform-action transmit exceed-action drop
rate-limit input access-group 137 128000 24000 48000 conform-action transmit exceed-action drop
rate-limit input access-group 139 64000 12000 24000 conform-action transmit exceed-action drop
ip route-cache flow
no ip mroute-cache
no keepalive
half-duplex
traffic-shape group 116 96000 12000 12000 128
traffic-shape group 118 256000 32000 32000 128
traffic-shape group 120 64000 8000 8000 128
traffic-shape group 122 96000 12000 12000 128
traffic-shape group 124 96000 12000 12000 128
traffic-shape group 126 96000 12000 12000 128
traffic-shape group 128 96000 12000 12000 128
traffic-shape group 130 64000 8000 8000 128
traffic-shape group 132 64000 8000 8000 128
traffic-shape group 136 64000 8000 8000 128
traffic-shape group 138 128000 16000 16000 128
traffic-shape group 140 64000 8000 8000 128
no cdp enable
!
interface Serial0/1
no ip address
shutdown
!
interface FastEthernet2/0
ip address 193.xxx.xxx.9 255.255.255.192
ip access-group 199 in
no ip unreachables
no ip proxy-arp
ip nat inside
rate-limit input access-group 111 512000 96000 192000 conform-action transmit exceed-action drop
rate-limit input access-group 113 96000 18000 36000 conform-action transmit exceed-action drop
rate-limit input access-group 133 32000 6000 12000 conform-action transmit exceed-action drop
ip route-cache flow
no ip mroute-cache
no keepalive
speed 100
full-duplex
traffic-shape group 112 512000 32000 32000 512
traffic-shape group 114 96000 12000 12000 128
traffic-shape group 134 32000 4000 4000 128
no cdp enable
!
ip nat inside source list 5 interface Ethernet0/0 overload
ip nat inside source list 102 interface Ethernet0/0 overload
ip flow-export source FastEthernet2/0
ip flow-export version 5
ip flow-export destination 193.xxx.xxx.1 2100
ip classless
no ip http server
!
access-list 5 permit 192.168.1.249
access-list 5 permit 192.168.1.253
access-list 5 permit 192.168.4.0 0.0.0.255
access-list 5 permit 192.168.12.0 0.0.0.255
access-list 5 permit 192.168.14.0 0.0.0.255
access-list 5 permit 192.168.23.0 0.0.0.255
access-list 5 permit 192.168.6.0 0.0.0.255
access-list 5 permit 192.168.29.0 0.0.0.255
access-list 5 permit 192.168.20.0 0.0.0.255
access-list 5 permit 192.168.5.0 0.0.0.255
access-list 5 permit 192.168.30.0 0.0.0.255
access-list 102 permit ip any host 212.109.57.226
access-list 102 permit ip any host 213.186.198.70
access-list 102 permit ip any host 62.244.21.62
access-list 102 permit ip any host 212.82.220.134
access-list 103 permit ip any 192.168.0.0 0.0.255.255
access-list 199 remark Zhashishaemsa ot nekotorih virusov
access-list 199 deny tcp any any eq 135
access-list 199 deny udp any any eq 135
access-list 199 permit ip any any
!
route-map netflow_nat permit 10
match ip address 103
set interface Loopback0 Ethernet0/0
!
line con 0
line aux 0
line vty 0 4
!
end
