Имеем Cisco 7120, IOS 12.3(12e)
Поднят pptp-клиент на прова и pptp-сервер для клиентов. Между этими интерфейсами сооружен nat.
Вешаю на virtual-template pptp сервера
ip route-cache flow и получаю фигу! netflow собирает траф с интерфейса fastEthernet0/1 (через него устанавливаются входящие VPN), но не собирает траф с самих VPN соединений. Причем на Fa0/1
ip route-cache flow не вешал...
мой конфиг:
Код:
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service internal
!
hostname Router
!
boot-start-marker
boot bootldr bootflash:
boot-end-marker
!
enable secret 5 хххххххххх
enable password 7 ххххххххх
!
username root privilege 15 secret 5 хххххх
syscon address 10.0.0.100 public_bg
syscon shelf-id 0
aaa new-model
aaa session-mib disconnect
!
!
aaa authentication login default local
aaa authentication ppp default group radius local
aaa authorization exec default local
aaa authorization network default group radius group radius
aaa accounting delay-start
aaa accounting update periodic 1
aaa accounting network default start-stop group radius
aaa session-id common
ip subnet-zero
no ip gratuitous-arps
ip flow-cache entries 1024
ip flow-cache timeout inactive 10
ip flow-cache timeout active 1
!
ip cef
ip audit po max-events 100
vpdn enable
!
vpdn-group 1
request-dialin
protocol pptp
rotary-group 0
initiate-to ip 192.168.222.2
!
vpdn-group 2
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
no ftp-server write-enable
!
!
interface Loopback1
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
ip address 192.168.222.8 255.255.255.0
!
interface FastEthernet0/1
ip address 10.0.0.1 255.255.255.0
ip nat inside
no mop enabled
!
interface ATM1/0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Virtual-Template1
ip unnumbered Loopback1
ip nat inside
ip route-cache flow
ppp authentication chap
!
interface Dialer0
mtu 1450
ip address negotiated
ip nat outside
encapsulation ppp
ip route-cache flow
dialer in-band
dialer idle-timeout 0
dialer string 123
dialer vpdn
dialer-group 1
no cdp enable
ppp pfc local request
ppp pfc remote apply
ppp encrypt mppe auto
ppp chap hostname cisco
ppp chap password 7 0822455D0A1615160118
!
ip nat inside source list 1 interface Dialer0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
ip flow-export source FastEthernet0/1
ip flow-export version 5
ip flow-export destination 10.0.0.100 2001
no ip http server
no ip http secure-server
!
!
ip radius source-interface FastEthernet0/1
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 10.0.222.0 0.0.0.255
access-list 3 permit 10.0.0.100
access-list 3 deny any log
dialer-list 1 protocol ip permit
!
snmp-server community public RO
snmp-server community public_bg RW 3
snmp-server ifindex persist
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server host 10.0.0.100 161
snmp-server host 10.0.0.100 2c
snmp-server host 10.0.0.100 aaa
snmp-server host 10.0.0.100 public_bg
!
radius-server attribute 8 include-in-access-req
radius-server attribute nas-port format e UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
radius-server attribute 31 mac format unformatted
radius-server configure-nas
radius-server host 10.0.0.100 auth-port 1812 acct-port 1813 key 7 01425457
radius-server vsa send accounting
radius-server vsa send authentication
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
!
end