Russian Users MikroTik | Форум пользователей MikroTik

Здравствуйте!

У меня вот такая конфигурация сети:

Cisco (192.168.65.52) ---> (192.168.65.253) Mikrotik (192.168.63.253) ---> NetFlowCollector (192.168.63.248)

Cisco настроена отправлять netflow v5 и v9 на один и тот же коллектор, но на разные порты. Вот, что я вижу в логе работы файрвола на микротике:

Соответственно, 63.248 на порту 9995 получает трафик с некорректным для моей задачи IP. Откуда берется подмена адреса я никак понять не могу. Правило маскарадинга у микротика только одно:

Если с циски делать пинг, телнет на любой порт (в т.ч. 9995), делать трассировку (udp) - дампом на 192.168.63.248 я всегда вижу корректный src адрес 192.168.65.52
Помогите, пожалуйста, советом! Второй день уже бьюсь над разгадкой.

Mikrotik - 2011UiAS (RouterOS 6.31)

Конфиг netflow c циски:
v9

v5

Ну видимо еще что то есть.
NAT весь покажите

/ip firewall nat
add chain=srcnat dst-address=192.168.100.0/24 src-address=192.168.63.0/24
add chain=srcnat dst-address=192.168.130.0/24 src-address=192.168.63.0/24
add chain=srcnat dst-address=192.168.16.0/24 src-address=192.168.63.0/24
add action=src-nat chain=srcnat dst-address=134.xx.0.0/16 src-address=0.0.0.0/0 to-addresses=134.xx.xx.xx
add action=src-nat chain=srcnat dst-address=130.xx.0.0/16 src-address=0.0.0.0/0 to-addresses=134.xx.xx.x
add action=src-nat chain=srcnat dst-address=92.120.xx.0/22 src-address=0.0.0.0/0 to-addresses=134.xx.xx.xx
add action=dst-nat chain=dstnat dst-address=178.16.xx.xx dst-port=38080 protocol=tcp to-addresses=192.168.63.236 to-ports=8080
add action=dst-nat chain=dstnat dst-address=178.16.xx.xx dst-port=8002 protocol=tcp to-addresses=192.168.63.236 to-ports=8002
add action=dst-nat chain=dstnat dst-address=178.16.xx.xx dst-port=8000 protocol=tcp to-addresses=192.168.63.236 to-ports=8000
add action=dst-nat chain=dstnat dst-address=178.16.xx.xx dst-port=38022 protocol=tcp to-addresses=192.168.63.236 to-ports=22
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx protocol=tcp to-addresses=192.168.63.225
add action=dst-nat chain=dstnat dst-address=178.16.xx.xx dst-port=389 log=yes protocol=tcp src-address=185.22.xx.xx to-addresses=192.168.63.220
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=389 protocol=tcp src-address=185.22.xx.xx to-addresses=192.168.63.220
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=53 protocol=udp src-address=0.0.0.0/0 to-addresses=192.168.63.85 to-ports=53
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=22 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.40
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=1723 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.253 to-ports=1723
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=81 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.39 to-ports=81
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=82 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.39 to-ports=82
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=3000 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.198 to-ports=3000
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=3002 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.198 to-ports=3002
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=8080 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.140 to-ports=8080
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=8181 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.137 to-ports=8080
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.54
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=8443 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.235 to-ports=8443
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=8081 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.74
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=22 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.85
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=80 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.40
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=80,3000 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.240 to-ports=3000
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=20,21,22 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.19
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=5101,80,8080 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.189
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=1723 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.188 to-ports=1723
add action=dst-nat chain=dstnat dst-address=93.153.xx.xx dst-port=1723 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.188 to-ports=1723
add action=dst-nat chain=dstnat dst-address=93.153.xx.xx dst-port=22 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.40 to-ports=22
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=8080 protocol=tcp src-address=131.103.20.0/24 to-addresses=192.168.63.40
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=389,636 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.88
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=80 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.239
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=80,443 protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.18
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=80 protocol=tcp src-address=195.5.xx.xx to-addresses=192.168.63.166 to-ports=80
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=80 protocol=tcp src-address=212.119.xx.xx to-addresses=192.168.63.166 to-ports=80
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx dst-port=80 protocol=tcp src-address=212.119.xx.xx to-addresses=192.168.63.166 to-ports=80
add action=dst-nat chain=dstnat dst-address=85.114.xx.xx protocol=tcp src-address=0.0.0.0/0 to-addresses=192.168.63.120
add action=masquerade chain=srcnat dst-address=!192.168.0.0/16 out-interface=ether10

маршруты и манагл еще покажите

/ip firewall mangle
add action=mark-connection chain=input dst-address=93.153.xx.xx in-interface=ether9 new-connection-mark=megafon
add action=mark-routing chain=output connection-mark=megafon new-routing-mark=megafon add chain=prerouting dst-address=!85.114.xx.xx/26 dst-port=80 protocol=tcp src-address=192.168.63.71
add chain=prerouting dst-address=!85.114.xx.xx/26 dst-port=80 protocol=tcp src-address=192.168.63.217
add chain=prerouting dst-address=!85.114.xx.xx/26 dst-port=80 protocol=tcp src-address=192.168.63.137
add chain=prerouting dst-address=!85.114.xx.xx/26 dst-port=80 protocol=tcp src-address=192.168.63.114
add chain=prerouting dst-address=!85.114.xx.xx/26 dst-port=80 protocol=tcp src-address=192.168.63.191
add chain=prerouting dst-address=!85.114.xx.xx/26 dst-port=80 protocol=tcp src-address=192.168.63.176
add chain=postrouting dst-address=192.168.100.97 src-address=192.168.63.40
add chain=postrouting dst-address=192.168.100.91 src-address=192.168.63.40
add chain=postrouting dst-address=0.0.0.0/0 protocol=ipsec-esp src-address=0.0.0.0/0
add chain=postrouting dst-address=192.168.100.0/24 src-address=192.168.63.0/24
add chain=postrouting dst-address=192.168.130.0/24 src-address=192.168.63.0/24
add chain=postrouting dst-address=192.168.16.0/24 src-address=192.168.63.0/24
add chain=postrouting dst-address=192.168.63.0/24 src-address=192.168.22.0/24
add chain=postrouting dst-address=10.213.0.0/16 src-address=192.168.63.0/24

/ip route
add check-gateway=arp distance=5 gateway=178.16.xx.xx
add check-gateway=arp distance=10 gateway=93.153.xx.xx
add check-gateway=arp distance=1 dst-address=92.120.xx.xx/22 gateway=192.168.83.1
add check-gateway=arp distance=1 dst-address=134.xx.xx.xx/16 gateway=192.168.83.1
add check-gateway=arp distance=1 dst-address=165.xx.xx.xx/16 gateway=192.168.83.1
add distance=1 dst-address=192.168.1.0/24 gateway=192.168.88.1
add check-gateway=arp distance=1 dst-address=192.168.16.0/24 gateway=192.168.100.253
add distance=1 dst-address=192.168.66.0/24 gateway=192.168.65.52
add distance=1 dst-address=192.168.67.0/24 gateway=192.168.65.52
add distance=1 dst-address=192.168.68.0/24 gateway=192.168.65.52
add distance=1 dst-address=192.168.69.0/24 gateway=192.168.65.52

Вроде как ОК все.

А в каком месте вы легирование воткнули что бы данную строчку увидеть?
net65forward: in:ether2 out:LAN, src-mac 00:1b:d4:e2:9e:3d, proto UDP, 192.168.65.52:61758->192.168.63.248:9995, NAT (192.168.65.52:61758->192.168.63.253:61758)->192.168.63.248:9995, len 370

chain=forward action=accept src-address=192.168.65.0/24 log=yes log-prefix="net65"

Зацените работу микротика:

11:47:45 firewall,info netflow forward: in:ether2 out:LAN, src-mac 00:1b:d4:e2:9e:3d, proto UDP, 192.168.65.52:56598->192.168.63.248:9995, len 244
11:47:46 firewall,info netflow forward: in:ether2 out:LAN, src-mac 00:1b:d4:e2:9e:3d, proto UDP, 192.168.65.52:61758->192.168.63.248:9995, NAT (192.168.65.52:61758->192.168.63.253:61758)->192.168.63.248:9995, len 264

Первый пакет - циска отправила netflow v5, второй пакет - netflow v9

Нет идей?

6.32.2 решила проблему