Flexible NetFlow Causing DNS Issues

Question

I recently deployed Flexible NetFlow on some of my 2821 routers (Version 12.4(9)T3). This was required because I needed to export my flow records via an IPSEC / GRE tunnel, and traditional NetFlow wouldn't encapsulate within the IPSEC tunnel. So I migrated to Flexible NetFlow. As soon as I did this all DNS queries from hosts on the inside network began to fail. has anyone seen this issue? Is there a fix? Currently I have simply turned off NetFlow collection on the routers in question.
Config:
flow exporter StoFlowExporter
destination 10.x.x.x
source GigabitEthernet0/0.461
transport udp 2055
flow monitor StoNetFlow
record netflow ipv4 original-input
exporter StoFlowExporter
interface GigabitEthernet0/0.461
description LAN
encapsulation dot1Q 461
ip address 10.x.x.x 255.255.255.0
ip access-group LAN_Outbound in
ip flow monitor StoNetFlow input
ip nat inside
ip virtual-reassembly
Thanks,

Answer 1

It sound like you somehow have have got the ethernet 2 interface as the topmost interface in the Network settings "service order" which is a good thing for routing. The 192.168.1.0/24 network interface doesn't need a router setting but it will work as it is.
The modem is really also working as a NAT router and probably sending out IPs through DHCP to machines on that subnet (the Server's "WAN"), but the server needs to have a static IP on that subnet so you can add it to your DNS server settings instead of 192.168.1.3 (or use both IPs in DNS server config for the same name but it's probably better to have only one because of the reverse IP lookup) as the machine will use the topmost interface as the default for it's name and services. The server will answer on the 192.168.1.3 inteface too for most services. If the server does NAT (probably is running the firewall and NAT?) Internet access should work without any static routes in the modem/router but you will have dual NAT from the server LAN (192.168.1.0/24 subnet).
Both these subnets IP-"ranges" isn't using recommended values if you want to use the server for VPN later, as either one of those is the default on most broadband routers.
Your setup looks like modem/router<-->server en port 2>--<server en port 1>---LAN switch<--->LAN client computers?
You probably don't need to use both interfaces on the server as you (can/should) use only your modem/router for NAT but some people want to run the firewall in OS X server especiallay if forwarding a "DMZ" port from their internet router to the server IP.
Just the servername should be in the "Sharing" setup and the domainname in "Search domain" field in Network config.
So in your case "smcoserver" and "private" respectively.