Collect data netflow on the load decrypted in IPSec traffic

Hello

I have a case where our customers have an IPSec Site to Site tunnel, where traffic is hair-pin on a 2901 router.

They would collect netflow on the load decrypted for accounting purposes.

The problem is that according to the order of operations on the router IOS, the netflow is recorded before the packet is decrypted penetration, and after the package is encrypted evacuation.

Is there a solution to this, or someone has experience with alternative solutions for this scenario?

(e.g. DURATION encrypted traffic to another device which decrypts and generate netflow data?)

Best regards

Steffen

Hey, Steffen,.

Yes the path of the EFC is so different [Card Crypto is a feature of output while the Tunnel Protection is a feature of post-encap].

Therefore, we can apply all feature output such as netflow on a tunnel or a virtual-template interface since then we validate the traffic post-decapsulation.

An example of one of my box [a vpn to 4.2.2.2 peer ping]. NetFlow which attracts traffic after decryption.

R1 - HUB #sh ip cache flow. I Vi1

Vi1 172.16.1.1 Et0/1 4.2.2.2 01 0000 0800 153

See you soon,.

Olivier

Tags: Cisco Security

Similar Questions

  • We get an error when I try to collect data from vCenter Server. But the Collection of Cluster works!

    Hello

    I m getting a strange errormessage when he tries to load my vCenter Server inventory.

    I have configured my vCenter Server as the endpoint server and I was able to load the Clusters. When I klick collection of data in a Cluster (Cluster of EQL 1) I can load all the data and the State is 'successful', but when I try to load the inventory FRO the vCenter Server (to get the models) im getting this error message:

    The treatment [inventory], error details error: illegal managed object reference type, folder.

    The same schows Agent logs:

    [26.08.2014 16:48:16] [Info]: start: treatment Workitem ID [2e38598e-4385-4b2d-bc88-fd2b773d1f98] [inventory]

    [26.08.2014 16:48:16] [Debug]: [[inventory]] [inventory] VirtualMachine.Admin.Hostname = vCenter

    [26.08.2014 16:48:16] [Debug]: [[inventory]] VirtualMachine.Admin.ParentIdentity = [inventory]

    [26.08.2014 16:48:16] [Debug]: [[inventory]] [inventory] VirtualMachine.ManagementEndpoint.Name = vCenter

    [26.08.2014 16:48:16] [Debug]: [[inventory]] VirtualMachine.ManagementEndpoint.Identity = [inventory]

    [26.08.2014 16:48:16] [Debug]: [[inventory]] [inventory] VirtualMachine.ManagementEndpoint.Endpoint0 = vCenter

    [26.08.2014 16:48:16] [Debug]: [[inventory]] [inventory] VirtualMachine.Admin.Name = inventory

    [26.08.2014 16:48:16] [Error]: <? XML version = "1.0" encoding = "utf-16"? >

    < Boolean > false < / Boolean >

    Error parsing [inventory], details of the error:

    System.ArgumentException: Illegal managed object reference type, folder.

    at DynamicOps.Vrm.Agent.vSphere.VSphereGetHostsRequest.ExecuteImpl)

    at DynamicOps.Vrm.Agent.vSphere.VSphereHypervisorServiceProvider.GetHosts (ManagementEndpoint managementEndpoint)

    to DynamicOps.Vrm.Agent.Collector'3.get_Hosts)

    to DynamicOps.Vrm.Agent.Collector'3.CollectManagementEndpoints)

    to DynamicOps.Vrm.Agent.CollectInventory'3.Collect)

    to DynamicOps.Vrm.Agent.BaseHypervisorAgent'3.EnumerateHypervisorResources (collector collector 3, WorkItem workItem, PropertyBagHelper propertyBagHelper)

    to DynamicOps.Vrm.Agent.BaseHypervisorAgent'3.ProcessWorkitem (WorkItem workItem, task of the chain, PropertyBagHelper propertyBag)

    to DynamicOps.Vrm.Agent.vSphere.VSphereAgentService.ProcessWorkitem (WorkItem workItem, task of the chain, PropertyBagHelper propertyBag)

    to DynamicOps.Vrm.Agent.BaseAgent.ProcessWorkitem (WorkItem workItem)

    I hope that someone had an idea, im out of ideas.

    THX Steven

    There is no data for the endpoint collection... And I'm not entirely sure of how you added the vCenter object it... y at - it a calculation object named "vCenter? To answer your specific questions about the models, however, they must be stored on a cluster that is part of the tissue group for data collection to pick them up... They are not considered as a global entity (as a resource calculation). Add models to one of the clusters and then to collect data on it, and you should be fine.

  • My verse ATT modem (non apple devices to use this modem} is connected to the ATT line, Time Capsule (iPhones, Macs Time Capsule use) via ethernet Uverse.) Non apple devices can collect data from iPhones or Mac using the time Capsule?

    My verse ATT modem ({use of devices not apple wifi of this modem} is connected to the ATT line, Time Capsule (iPhones, Macs use the wifi of the time Capsule) and connect to the Uverse modem via ethernet.)

    Both devices are set to the highest security and each uses separate passwords.

    Non apple devices can collect data from iPhones or Mac using the time Capsule?

    With a bit of work by someone who knows how to do such things, not Apple computers could read some files on the Mac if file sharing is configured on the network... devices non-Apple and... He knew the device passwords or administrator for Macs.

    Mac could also play the files on other Macs if file sharing has been implemented and the device password or admin was known.

    If you ask if a PC can read the files on the Time Capsule, the answer is Yes, without doubt, assuming that the PC knew the password of device for the time Capsule.

  • Upgrading to Windows 7: compatibility of the device data could not be loaded

    I tried to upgrade my L300 (and otherwise my P300) from Vista to Win 7 with two DVDs of upgrade provided by Toshiba end 2009. I followed all the instructions, as to recover the system to the State of delivery, deletion of outdated drivers and install new drivers with the DVD driver. But when I insert the Win 7 DVD and start the installation, I soon get the following (originally in German) error message:
    "The device compatibility data could not be loaded. Error code 0x1F.*.
    German support Toshiba could not answer my question so far, then I wonder what is the problem and how do I get my installation is going. It's kind of frustrating after paying for the upgrade DVD, but the installation does not work.
    Thanks in advance for any help on this error.

    And after a year using it for the first time now, right?

  • Try to get data of almost static load of the 9234 module with IEPE sensors

    I am train to acquire data of load which should be essentially a function of the square wave loading. The current configuration I have is cDAQ 9234 on LV 8.5 module that I used to start a module of 9233, I had, but after looking for here and that it seemed to me that the 9234, with DC coupling, would allow me to gain the quasi-static load (the load is applied for 2.5 seconds) and not only the load change whenever the load has been applied or removed. So, now I have connected 9234 and I get almost no change in output regardless of whether I got DC or AC coupling selected in MAX. In addition, it always seems to be only to register the initial support change, as before - it's the biggest concern I have.

    I had previously configured as a voltage signal and just put across the entrance, which at least made me reasonable support changes when I used the 9233. I expect at least that I would see the same or similar values with the configured 9234 in AC mode. If anyone can shed some light on this I would be very happy.

    Here are the technical details of load cell: http://www.dytran.com/img/products/1203V.pdf

    I have also attached my code, in which case it might shed some light on the question (please, be gentle - I do not know there is a better way to code this, but I have tried different methods cleaning cycle not properly).

    Thanks in advance for any help!

    John,

    Both the sine part and the exponential decay are indications provide excitement from HQ or using a sensor that uses AC coupling.  Looking at the datasheet that you have linked and the site Web of Dytran, I can't determine if the load cell has any kind of internal coupling of AC.  I would recommend you contact Dytran and explain the behavior that you see a load constant to see if this is expected behaviour or not.  It is possible that the scale is intended primarily for transient or dynamic loading and was not supposed to measure static charges.  Let me know what you hear from Dytran and we can continue to resolve this.

  • Collect data from specific frequency of the power spectrum

    Hello

    I want to know how to collect data from specific frequency of power spectrum file. I'm trying to separate data from specific frequency of the original file.

    This will depend on much how your data is stored. You will need a way to read the file in LabVIEW and then a way to identify the data you want. I often record data in a .csv file, then I use "Reading worksheet" to get the data in a table. Then, you can simply use 'Index Array' to get the datapoints you need.

  • How to collect data on the programs of LabView and VC ++ at the same time?

    Hello

    There are two programs in LabVIEW and another is in VC ++. The two programs to collect hardware data.

    Therefore, for the experience, it is necessary to begin to collect data at the same time and lag must be

    less than millisecond (it is essential for the experience). How can this be achieved? BTW, I'm new to LabView.

    I think on the use of network socket to get the message for both applications.

    I was wondering if there is a better way.

    Thank you.

    MARK002-MAB wrote:

    Hello

    There are two programs in LabVIEW and another is in VC ++. The two programs to collect hardware data.

    Therefore, for the experience, it is necessary to begin to collect data at the same time and lag must be

    less than millisecond (it is essential for the experience). How can this be achieved? BTW, I'm new to LabView.

    I think on the use of network socket to get the message for both applications.

    I was wondering if there is a better way.

    Thank you.

    You do not say if two programs access the same material, but I guess not. Because if they did, you probably get conflicts when the two programs try to access the same material at the same time.

    In either case, the only really reliable way to ensure that your needs of< 1ms="" would="" be="" hardware="" triggering.="" one="" hardware="" unit="" is="" programmed="" to="" provide="" a="" hardware="" trigger,="" typically="" a="" digital="" signal="" and="" the="" other="" is="" programmed="" previous="" to="" the="" desired="" start="" point,="" to="" wait="" for="" that="" trigger="" and="" start="" automatically="" when="" it="" is="" received.="" if="" both="" hardware="" units="" are="" ni="" daq="" cards="" you="" can="" do="" that="" fairly="" easily="" using="" the="" rtsi="" bus="" or="" in="" case="" of="" pxi="" the="" pxi="" trigger="" lines.="" if="" they="" are="" different="" hardware="" then="" it="" can="" get="" more="" complicated="" to="">

  • Update fail, have 3 updates that load, but then the icon appears again advise that even the dates are ready for loading.

    I have Windows XP Home Edition Version 2002 Service Pack 3.  I have 3 updates that load, but then the icon appears again advise that even the dates are ready for loading.  Is it possible that updates sent me are for the 2003 Version?  Whenever I update these 3 updates, a window shows updated loading successfully, but they still remain as an icon in my taskbar?

    CrystalBall © SEZ...

    See the RESPONSE message in this thread-online http://answers.microsoft.com/thread/49ed2fe1-6782-4498-814a-ccfa6ec1dfc9

  • Limiting the size of data that can be loaded up via BES (JSR - 172 or kSOAP2 is used)

    Hi all

    I want to up load data from the device to the application server. (via BES)

    I use JSR-172 or kSOAP2 high-load it.

    Is there a limitation in the size of the data that can be loaded at the top?

    Hello

    as far as I know, they're just the protocols/utils. They help you define the message format, the specification on how you are going to write/read data and tastes. so I think that all this goes down to the http.

  • What ever the data that we are loading in HFM, how to check if the data are correct or not?

    Hello!

    This is SANDEEP, I loaded data using FDM in HFM. How to check if the data is correct or not, what ever the data I was responsible in HFM.

    Please tell me how to recover the data and what format, clearly can you me the data verification process step by step.

    It would be useful for me...

    Thanks in advance...

    Kind regards

    SANDEEP

    Hi Sandeep,

    I think the best way is to extract data from HFM for the same POV that you have loaded FDM and check if it is the same.

    If you then use HFM 11.1.2.x version

    1. login to the application and go to the menu Administration / extract / data.

    2. set the POV that you have loaded the data, then unzip it. You can open the file unzipped in a notebook

    3. you can compare the file with the data file generated by FDMEE under Outbox folder.

    But what would you give all the data corresponding to the POV that you set. So please ensure that you have the correct POV, defined according to the export FDMEE.

    Thank you

    Chandra

  • FDMEE error data import: No. periods have been identified for the loading of the data in the table "AIF_EBS_GL_BALANCES_STG".

    Hi experts,

    I tried to load the data of EBS in HFM via FDMEE.

    Importing data in the rule of loading, I have encountered an error in loading.

    2014-11-21 06:09:18, 601 INFO [AIF]: beginning of the process FDMEE, process ID: 268

    2014-11-21 06:09:18, 601 [AIF] INFO: recording of the FDMEE level: 4

    2014-11-21 06:09:18, 601 [AIF] INFO: FDMEE log file: D:\fdmee\outbox\logs\TESTING_268.log

    2014-11-21 06:09:18, 601 [AIF] INFO: user: admin

    2014-11-21 06:09:18, 601 INFO [AIF]: place: Testing_loc (Partitionkey:3)

    2014-11-21 06:09:18, 601 [AIF] INFO: name: OCT period (period key: 31/10/14 12:00 AM)

    2014-11-21 06:09:18, 601 INFO [AIF]: name of the category: real (category key: 1).

    2014-11-21 06:09:18, 601 INFO [AIF]: name rule: Testing_dlr (rule ID:8)

    2014-11-21 06:09:19, 877 [AIF] INFO: Jython Version: 2.5.1 (Release_2_5_1:6813, September 26 2009, 13:47:54)

    [JRockit (R) Oracle (Oracle Corporation)]

    2014-11-21 06:09:19, 877 INFO [AIF]: Java platform: java1.6.0_37

    2014-11-21 06:09:19, 877 INFO [AIF]: connect the file encoding: UTF-8

    2014-11-21 06:09:21, 368 [AIF] INFO: - START IMPORT STEP -

    2014-11-21 06:09:24, 544 FATAL [AIF]: error in CommData.insertImportProcessDetailsTraceback (most recent call last): File '< string >", line 2672, in insertImportProcessDetail

    RuntimeError: No periods have been identified for the loading of the data in the table 'AIF_EBS_GL_BALANCES_STG'.

    2014-11-21 06:09:24, 748 FATAL [AIF]: load balances data launch GL error

    2014-11-21 06:09:24, 752 [AIF] INFO: end process FDMEE, process ID: 268

    I found a post related to this error, but did not respond.

    I know I'm missing something, gurus please help me to overcome this error.

    ~ Thank you

    I managed to overcome this problem,

    This was caused due to an error in the map of the time.

    In the mapping of source, the name of period should be defined exactly as displayed in the EBS.

    for example: {EBS--> OCT - 14} FDMEE {mapping source--> OCT - 14}

    The names of the time must be identical.

  • ODI - the most recent version of the loading data

    Hello

    I have a flat file with the above structure

    No. MRN DATE OF BIRTH

    12345 12/04/1988

    12345 13/06/1980

    12345 21/05/1989

    The requirement is to load data into Oracle tables where only the last row must be taken (in this sense Date of birth for last MNR number must be picked, essentially the last disk)

    There is no verification of available data, which means that no insert_date or no matter what version number is available

    What is the best way to achieve this.

    Any help will be appreciated.

    Thanks and greetings

    Reshma

    In this case as you consider this last incoming data as more later. You should be able to choose later from the file in 2 ways (using the oracle sequence generated by default or manually, by creating a sequence).

    In the second case, when loading data to the staging table.

    Create a SNO_MRN_SEQ sequence in Oracle DB

    create sequences SNO_MRN_SEQ

    START WITH 1

    INCREMENT BY 1

    NOCACHE;

    Create an additional (SNO_SEQ) field in the staging data store, which in the mapping interface you will map the sequence (schema_name. SNO_MRN_SEQ. NEXTVAL).

    Check the staging table data if the sequence is empty as expected.

    during the loading to the filter of the target on MRN_NO Table and use the below query, which will essentially come to the max of the sequence number.

    STGTABLE. SNO_SEQ =

    (SELECT MAX (B.SNO_SEQ)

    OF STAGING_TABLE B

    WHERE STGTABLE. MRN_NO = B.MRN_NO

    )

    Let me know if that helps!

  • Collect data through HTML form using the Web content viewer?

    I have a folio that is perceived through the content viewer Adobe, built with Digital Publishing Suite. I have a registration form where I'll need to collect responses from people and their contact information. I have a HTML file that I placed in InDesign, and rail shape. But how can we content submitted through sending form through my email? I need a PHP file as well?

    If you create a form, for example, with action = "mailto:[email protected]" method = "POST" all elements inside the form entry will be enters the body of the message.

    However, the disadvantage is that the user will have its own program by default mail which will open (focus) web viewer and try to send the mail + which is more annoying, is that data are in the post office, so that you can not use automatically.

    a form to a php file action would be something more useful (and would also be an approach I would do).

  • XLS2COLLECTION in the collection date format

    Recently, I noticed the Date format imported into the collection as part of the XLS2COLLECTION is to come across as DD/MM/YYYY even if the XLS format is DD/MM/YYYY.  I can't seem to find a setting anywhere where it would change someone knows all the parameters that affect this format?

    XLS2COLLECTION

    I actually reached out to my contact at Oracle to get some clarification on this and he was kind enough to return after scanning through the code that is actually a HARD-CODED in the earphone date format.  He recommended to post something in the forum of listener to try and address the potential for improvement, but for now it looks like it's like that and in my case, I need to code exception to reformat the date in my application.

    Thanks for your comments to Mike!

  • When loading, error: field in the data file exceeds the maximum length

    Oracle Database 11 g Enterprise Edition Release 11.2.0.3.0 - 64 bit Production

    PL/SQL Release 11.2.0.3.0 - Production

    CORE Production 11.2.0.3.0

    AMT for Solaris: 11.2.0.3.0 - Production Version

    NLSRTL Version 11.2.0.3.0 - Production

    I am trying to load a table, small size (110 lines, 6 columns).  One of the columns, called NOTES is less error when I run the load.  That is to say that the size of the column exceeds the limit max.  As you can see here, the column of the table is equal to 4000 bytes)

    CREATE TABLE NRIS. NRN_REPORT_NOTES

    (

    Sys_guid() NOTES_CN VARCHAR2 (40 BYTE) DEFAULT is NOT NULL.

    REPORT_GROUP VARCHAR2 (100 BYTE) NOT NULL,

    POSTCODE VARCHAR2 (50 BYTE) NOT NULL,

    ROUND NUMBER (3) NOT NULL,

    VARCHAR2 (4000 BYTE) NOTES,

    LAST_UPDATE TIMESTAMP (6) WITH ZONE SCHEDULE systimestamp NOT NULL default

    )

    TABLESPACE USERS

    RESULT_CACHE (DEFAULT MODE)

    PCTUSED 0

    PCTFREE 10

    INITRANS 1

    MAXTRANS 255

    STORAGE)

    80K INITIAL

    ACCORDING TO 1 M

    MINEXTENTS 1

    MAXEXTENTS UNLIMITED

    PCTINCREASE 0

    DEFAULT USER_TABLES

    DEFAULT FLASH_CACHE

    DEFAULT CELL_FLASH_CACHE

    )

    LOGGING

    NOCOMPRESS

    NOCACHE

    NOPARALLEL

    MONITORING;

    I did a little investigating, and it does not match.

    When I run

    Select max (lengthb (notes)) in NRIS. NRN_REPORT_NOTES

    I got a return of

    643

    .

    Which tells me that the larger size of this column is only 643 bytes.  But EACH insert is a failure.

    Here is the header of the file loader and first couple of inserts:

    DOWNLOAD THE DATA

    INFILE *.

    BADFILE '. / NRIS. NRN_REPORT_NOTES. BAD'

    DISCARDFILE '. / NRIS. NRN_REPORT_NOTES. DSC"

    ADD IN THE NRIS TABLE. NRN_REPORT_NOTES

    Fields ended by '; '. Eventually framed by ' |'

    (

    NOTES_CN,

    REPORT_GROUP,

    Zip code

    ALL ABOUT NULLIF (R = 'NULL'),

    NOTES,

    LAST_UPDATE TIMESTAMP WITH TIME ZONE ' MM/DD/YYYY HH24:MI:SS. FF9 TZR' NULLIF (LAST_UPDATE = 'NULL')

    )

    BEGINDATA

    | E2ACF256F01F46A7E0440003BA0F14C2; | | DEMOGRAPHIC DATA |; A01003; | 3 ; | demographic results show that 46% of visits are made by women.  Among racial and ethnic minorities, the most often encountered are native American (4%) and Hispanic / Latino (2%).  The breakdown by age shows that the Bitterroot has a relatively low of children under 16 (14%) proportion in the population of visit.  People over 60 represent about 22% of visits.   Most of the visitation comes from the region.  More than 85% of the visits come from people who live within 50 miles. | ; 29/07/2013 0, 16:09:27.000000000 - 06:00

    | E2ACF256F02046A7E0440003BA0F14C2; | | DESCRIPTION OF THE VISIT; | | A01003; | 3 ; | most visits to the Bitterroot are relatively short.  More than half of the visits last less than 3 hours.  The median duration of visiting sites for the night is about 43 hours, or about 2 days.  The average Wilderness visit lasts only about 6 hours, although more than half of these visits are shorter than the duration of 3 hours.   Most of the visits come from people who are frequent visitors.  Over thirty percent are made by people who visit between 40 and 100 times a year.  Another 8% of visits from people who say they visit more than 100 times a year. | ; 29/07/2013 0, 16:09:27.000000000 - 06:00

    | E2ACF256F02146A7E0440003BA0F14C2; | | ACTIVITIES |. A01003; | 3 ; | most often reported the main activity is hiking (42%), followed by alpine skiing (12%) and hunting (8%).  More than half of the report visits participating in the relaxation and the display landscape. | ; 29/07/2013 0, 16:09:27.000000000 - 06:00

    Here's the full start of log loader, ending after the return of the first row.  (They ALL say the same error)

    SQL * Loader: Release 10.2.0.4.0 - Production Thu Aug 22 12:09:07 2013

    Copyright (c) 1982, 2007, Oracle.  All rights reserved.

    Control file: NRIS. NRN_REPORT_NOTES. CTL

    Data file: NRIS. NRN_REPORT_NOTES. CTL

    Bad File:. / NRIS. NRN_REPORT_NOTES. BAD

    Discard File:. / NRIS. NRN_REPORT_NOTES. DSC

    (Allow all releases)

    Number of loading: ALL

    Number of jump: 0

    Authorized errors: 50

    Link table: 64 lines, maximum of 256000 bytes

    Continuation of the debate: none is specified

    Path used: classics

    NRIS table. NRN_REPORT_NOTES, loaded from every logical record.

    Insert the option in effect for this table: APPEND

    Column Position Len term Encl. Datatype name

    ------------------------------ ---------- ----- ---- ---- ---------------------

    FIRST NOTES_CN *;  O (|) CHARACTER

    REPORT_GROUP NEXT *;  O (|) CHARACTER

    AREA CODE FOLLOWING *;  O (|) CHARACTER

    ROUND                                NEXT     *   ;  O (|) CHARACTER

    NULL if r = 0X4e554c4c ('NULL' character)

    NOTES                                NEXT     *   ;  O (|) CHARACTER

    LAST_UPDATE NEXT *;  O (|) DATETIME MM/DD/YYYY HH24:MI:SS. FF9 TZR

    NULL if LAST_UPDATE = 0X4e554c4c ('NULL' character)

    Sheet 1: Rejected - error in NRIS table. NRN_REPORT_NOTES, information ABOUT the column.

    Field in the data file exceeds the maximum length.

    I don't see why this should be failed.

    Hello

    the problem is bounded by default, char (255) data... Very useful, I know...

    you need two, IE sqlldr Hat data is longer than this.

    so change notes to notes char (4000) you control file and it should work.

    see you soon,

    Harry

Maybe you are looking for

  • The Firefox browser is not visible on the home screen, but "browser" is available.

    I just got my LG fx0 and the Firefox browser is not on the phone. I watched videos on youtube and all phones in the videos than the Firefox browser. Why is this and how to install Firefox? Section 'system information' the model is madai and the softw

  • Satellite P100-347: I'm tired of this!

    On 30 March, I bought a new Toshiba laptop (P100-347) that was advertised as coming with a FREE update to Windows Vista. The guys at the shop told me that the only thing I have to do to get this update is contact Toshiba. I'm going home and I realize

  • GameSpy will stop will be my game works?

    Hello GameSpy will close may 31. Command and conquer generals and expansion (zero hour) are powered by Gamespy? I hope that no, really, I always like play online with it. the experience on it is much better then Gamerager and I hope that this game is

  • ERROR CODE KB 970653 CANNOT UPDATE ERROR 800706431 CODE

    ERROR CODE KB 970653... CANNOT UPDATE... 800706431 ERROR CODE. DIDN'T TRY TO UPDATE SEVERAL TIMES NO LUCK. CAN ANYONE HELP PLEASE

  • Good site to learn more about the 'new' Task Manager.

    Just bought back nine Windows XP Media Center Edition, Version 2002 with Service Pack 3. Used XP Pro for years and understood all of the items listed in the Task Manager.  This list of 'new' Task Manager has all sorts of items listed which I don't re