NetFlow - applying to an SVI
Applying NetFlow to an SVI has several pros and cons compared to its application on a physical interface:
- If you deploy it on an SVI, you can monitor and analyze the aggregated traffic from multiple physical interfaces associated with the same VLAN.
- NetFlow on an SVI can also monitor and analyze traffic flowing between different VLANs, which is useful for understanding communication patterns between subnets.
- By configuring NetFlow on an SVI, you reduce the number of NetFlow instances needed, since you need only one instance per VLAN rather than one instance per interface, thus you use fewer resources.
- However, NetFlow on an SVI will only monitor traffic that is destined to or comes from other subnets. You won’t be able to monitor traffic within the VLAN itself, since such traffic would go directly between hosts and would not traverse the SVI.
If you apply NetFlow to physical interfaces, then:
- You have more visibility to traffic that goes between hosts on the same VLAN
- This becomes more resource intensive and complex since you have more NetFlow configurations to perform and more NetFlow sessions (one per configured physical interface), making it less scalable and more challenging to manage.
Links:
https://forum.networklessons.com/t/introduction-to-cisco-netflow/1278/75?u=lagapides
https://networklessons.com/cisco/ccie-routing-switching/introduction-to-cisco-netflow/