How To Configure Cisco NetFlow

Cisco NetFlowNetFlow is used to collect data flows from interfaces. The information can be stored on the switch but more commonly sent to a server which collects the NetFlow data and spits it out into something shiny. Okay, not shiny but data more easily digestible.

Each packet is looked at for a set of IP packet attributes which are called key fields. The key fields help determine if the information within a packet is unique or similar to the other packets. If there are new values in the key fields then a new flow is created.

With that data you can create trend reports or gather protocol and interface statistics. In near real time you can find out who your top talkers are and what your most widely used protocols are traversing your network. It can even act as a security tool in finding network anomalies.

Netflow has 4 components:

  • Records
  • Exporter
  • Monitor
  • Sampler

The following NetFlow configuration was tested on a Cisco Catalyst 3850 running IOS version 15. On the Catalyst 3850, the exact version used is Flexible NetFlow (FNF). You will need at least IP Base licensing to use NetFlow. In short, Flexible NetFlow is Cisco’s migration from the traditional NetFlow. Aw how cute, it’s growing up.

Here is the full configuration I ended up with. After the configuration I go into more detail.

flow record AUNTFLOW
 match ipv4 destination address
 match ipv4 source address
 match ipv4 protocol
 match interface input
 match transport destination-port
 match transport source-port
 collect counter bytes long
 collect counter packets long
 collect interface input
 collect transport tcp flags
 collect timestamp absolute first
 collect timestamp absolute last
 flow exporter AUNTFLOWEXPORT
 description Export to netflow system
 source vlan 10
 transport udp 4739
 ttl 60
 flow monitor AUNTFLOWMON
 description Netflow monitor
 record AUNTFLOW
 cache timeout active 30
 description AUNTFLOW
 mode random 1 out-of 32
 interface range g1/0/1 - 48
 ip flow monitor AUNTFLOWMON sampler AUNTFLOWSAMPLER input

Step 1: Configure the Records

NetFlow uses key and nonkey values called a record. These records are then assigned to a monitor. Additionally, you can define what counters to collect. A key is used to match on attributes of a flow. A nonkey is used to identify what to collect from the matched flow.

flow record AUNTFLOW is the command to create the flow record.

match ipv4 destination address configures the IPv4 destination address as a key field. I found that you can have either ipv4 or ipv6 match statements but never both in the same flow. The switch gives you an error when you try to add ip flow monitor command to an interface.

match ipv4 source address configures the IPv4 source address as a key field.

match ipv4 protocol configures IPv4 protocol as a key field.

match interface input configures the input interface as a key field. You have the ability to use output as another option.

match transport destination-port configures the transport field as a key field.

match transport source-port configures the transport field as a key field.

collect counter bytes long sets the number of bytes in a flow as a nonkey field for a record. The bytes parameter configures the number of bytes seen in a flow as nonkey field and with the long parameter the flow uses a 64-bit counter.

collect counter packets long sets number of packets in a flow as a nonkey field. Uses a 64-bit counter.

collect interface input configures the input interface as a nonkey field and enables collection of the input interface from the flows.

collect transport tcp flags sets one or more TCP fields as a nonkey field

collect timestamp absolute first configures the absolute time of the first seen packet in a flow as a nonkey field.

collect timestamp absolute last configures the absolute time of the last seen packet in a flow as a nonkey field.

Step 2: Configure the Flow Exporter

The flow exporter exports the NetFlow data to a NetFlow collector. A NetFlow collector is a server that helps you analyze all the information you’re collecting.

flow exporter AUNTFLOWEXPORT creates a flow exporter called AUNTFLOWEXPORT.

description Export to netflow system creates a description for this flow exporter.

destination sets the destination host of the NetFlow collector.

source vlan 10 sets the source interface of the flow exporter.

transport udp 4739 sets the UDP port number to reach the NetFlow collector. Ranges from 0 – 65535.

ttl 60 sets the time-to-live (TTL) for datagrams sent by the exporter. Ranges from 1 – 255 seconds. Defaults to 255.

Step 3: Configure the Flow Monitor

The NetFlow monitor is what associates the exporter and the recorder. It is then applied to the interface ip flow monitor command.

flow monitor AUNTFLOWMON creates a flow monitor called AUNTFLOWMON.

description Netflow monitor sets a description.

exporter AUNTFLOWEXPORT associates the flow exporter we previously defined.

record AUNTFLOW associates the flow record we previously defined.

cache timeout active 30 associates a flow cache for the flow monitor to 30 seconds.

Step 4: Create a Sampler

I’m not talking about a beer sampler. A sample is used to select one out of “X” packets. This helps keep performance on the device in check.

sampler AUNTFLOWSAMPLER defines a sample called AUNTFLOWSAMPLER.

description AUNTFLOW creates a description.

mode random 1 out-of 32 creates a random sampling at a packet interval of one out of thirty-two packets.

Step 5: Apply NetFlow to Interfaces

interface range g1/0/1 - 48 selects a range of ports.

ip flow monitor AUNTFLOWMON sampler AUNTFLOWSAMPLER input applies the NetFlow monitor, AUNTFLOWMON, and NetFlow sampler, AUNTFLOWSAMPLER, to the interface for input packets.

Step 6: Verification

There are a number of show commands to keep handy when needing to troubleshoot or view your NetFlow data (on the router/switch).

show flow exporter
show flow interface
show flow monitor
show flow monitor cache format
show flow record
show sampler

That’s my afternoon with NetFlow.


Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

[gravityforms id=16 title=false description=false]
<script type="text/javascript">var gform;gform||(document.addEventListener("gform_main_scripts_loaded",function(){gform.scriptsLoaded=!0}),window.addEventListener("DOMContentLoaded",function(){gform.domLoaded=!0}),gform={domLoaded:!1,scriptsLoaded:!1,initializeOnLoaded:function(o){gform.domLoaded&&gform.scriptsLoaded?o():!gform.domLoaded&&gform.scriptsLoaded?window.addEventListener("DOMContentLoaded",o):document.addEventListener("gform_main_scripts_loaded",o)},hooks:{action:{},filter:{}},addAction:function(o,n,r,t){gform.addHook("action",o,n,r,t)},addFilter:function(o,n,r,t){gform.addHook("filter",o,n,r,t)},doAction:function(o){gform.doHook("action",o,arguments)},applyFilters:function(o){return gform.doHook("filter",o,arguments)},removeAction:function(o,n){gform.removeHook("action",o,n)},removeFilter:function(o,n,r){gform.removeHook("filter",o,n,r)},addHook:function(o,n,r,t,i){null==gform.hooks[o][n]&&(gform.hooks[o][n]=[]);var e=gform.hooks[o][n];null==i&&(i=n+"_"+e.length),gform.hooks[o][n].push({tag:i,callable:r,priority:t=null==t?10:t})},doHook:function(n,o,r){var t;if(r=Array.prototype.slice.call(r,1),null!=gform.hooks[n][o]&&((o=gform.hooks[n][o]).sort(function(o,n){return o.priority-n.priority}),o.forEach(function(o){"function"!=typeof(t=o.callable)&&(t=window[t]),"action"==n?t.apply(null,r):r[0]=t.apply(null,r)})),"filter"==n)return r[0]},removeHook:function(o,n,t,i){var r;null!=gform.hooks[o][n]&&(r=(r=gform.hooks[o][n]).filter(function(o,n,r){return!!(null!=i&&i!=o.tag||null!=t&&t!=o.priority)}),gform.hooks[o][n]=r)}});</script> <div class='gf_browser_chrome gform_wrapper gravity-theme' id='gform_wrapper_16' ><form method='post' enctype='multipart/form-data' id='gform_16' action='/how-to-configure-cisco-netflow/' > <div class='gform_body gform-body'><div id='gform_fields_16' class='gform_fields top_label form_sublabel_below description_below'><fieldset id="field_16_1" class="gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible" data-js-reload="field_16_1"><legend class='gfield_label gfield_label_before_complex' >Name<span class="gfield_required"><span class="gfield_required gfield_required_text">(Required)</span></span></legend><div class='ginput_complex ginput_container no_prefix has_first_name no_middle_name no_last_name no_suffix gf_name_has_1 ginput_container_name' id='input_16_1'> <span id='input_16_1_3_container' class='name_first' > <input type='text' name='input_1.3' id='input_16_1_3' value='' aria-required='true' placeholder='First Name' /> <label for='input_16_1_3' >First</label> </span> </div></fieldset><div id="field_16_2" class="gfield gfield--width-full gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible" data-js-reload="field_16_2"><label class='gfield_label' for='input_16_2' >Email<span class="gfield_required"><span class="gfield_required gfield_required_text">(Required)</span></span></label><div class='ginput_container ginput_container_email'> <input name='input_2' id='input_16_2' type='text' value='' class='large' placeholder='Business email address' aria-required="true" aria-invalid="false" /> </div></div><fieldset id="field_16_3" class="gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible" data-js-reload="field_16_3"><legend class='gfield_label gfield_label_before_complex' >Consent<span class="gfield_required"><span class="gfield_required gfield_required_text">(Required)</span></span></legend><div class='ginput_container ginput_container_checkbox'><div class='gfield_checkbox' id='input_16_3'><div class='gchoice gchoice_16_3_1'> <input class='gfield-choice-input' name='input_3.1' type='checkbox' value='I consent to the processing and sharing with partners of the personal data that I provide Packet 6 for this activity in accordance with and as described in the &lt;a href=&quot;https://packet6.com/privacy-policy&quot; target=&quot;_new&quot;&gt;Privacy Policy&lt;/a&gt;' id='choice_16_3_1' /> <label for='choice_16_3_1' id='label_16_3_1'>I consent to the processing and sharing with partners of the personal data that I provide Packet 6 for this activity in accordance with and as described in the <a href="https://packet6.com/privacy-policy" target="_new">Privacy Policy</a></label> </div></div></div></fieldset><div id="field_16_4" class="gfield gform_validation_container field_sublabel_below field_description_below gfield_visibility_visible" data-js-reload="field_16_4"><label class='gfield_label' for='input_16_4' >Name</label><div class='ginput_container'><input name='input_4' id='input_16_4' type='text' value='' /></div><div class='gfield_description' id='gfield_description_16_4'>This field is for validation purposes and should be left unchanged.</div></div></div></div> <div class='gform_footer top_label'> <input type='submit' id='gform_submit_button_16' class='gform_button button' value='Get the report' onclick='if(window["gf_submitting_16"]){return false;} window["gf_submitting_16"]=true; ' onkeypress='if( event.keyCode == 13 ){ if(window["gf_submitting_16"]){return false;} window["gf_submitting_16"]=true; jQuery("#gform_16").trigger("submit",[true]); }' /> <input type='hidden' class='gform_hidden' name='is_submit_16' value='1' /> <input type='hidden' class='gform_hidden' name='gform_submit' value='16' /> <input type='hidden' class='gform_hidden' name='gform_unique_id' value='' /> <input type='hidden' class='gform_hidden' name='state_16' value='WyJbXSIsImY4MGVlNTA5MGVjMWYzYzU5NzUyOGFhOWE3ZGFiMzRlIl0=' /> <input type='hidden' class='gform_hidden' name='gform_target_page_number_16' id='gform_target_page_number_16' value='0' /> <input type='hidden' class='gform_hidden' name='gform_source_page_number_16' id='gform_source_page_number_16' value='1' /> <input type='hidden' name='gform_field_values' value='' /> </div> <p style="display: none !important;"><label>&#916;<textarea name="ak_hp_textarea" cols="45" rows="8" maxlength="100"></textarea></label><input type="hidden" id="ak_js_2" name="ak_js" value="160"/><script>document.getElementById( "ak_js_2" ).setAttribute( "value", ( new Date() ).getTime() );</script></p></form> </div>