Getting Started with Configuring Cisco IOS Flexible NetFlow

Emulating original NetFlow with Flexible NetFlow enables to you to deploy Flexible NetFlow quickly because you can use a predefined record instead of designing and configuring a custom user-defined record. You need only configure a flow monitor and apply it to an interface for Flexible NetFlow to start working like original NetFlow. You can add an optional exporter if you want to analyze the data that you collect with an application such as NetFlow collector.

Each flow monitor has a separate cache assigned to it. Each flow monitor requires a record to define the contents and layout of its cache entries. The record format can be one of the predefined record formats, or an advanced user may create his or her own record format using the collect and matchcommands in Flexible NetFlow flow record configuration mode.

Flow exporters are used to send the data that you collect with Flexible NetFlow to a remote system such as a NetFlow Collection Engine. Exporters use UDP as the transport protocol and use the Version 9 export format.

If you are familiar with original NetFlow, you already understand the format and content of the data that you collect and export with Flexible NetFlow when you emulate original NetFlow. You will be able to use the same techniques for analyzing the data.

The Flexible NetFlow "NetFlow original" and "NetFlow IPv4 original input" predefined records can be used interchangeably because they have the same key and nonkey fields. The key and nonkey fields and the counters for the Flexible NetFlow "NetFlow original" and "NetFlow IPv4 original input" predefined records are shown in the table below.

The configuration in the How to Get Started with Configuring Flexible NetFlow uses the predefined Flexible NetFlow "NetFlow original" record.

The Flexible NetFlow "NetFlow IPv4 original output" predefined record is used to emulate the original NetFlow Egress NetFlow Accounting feature that was released in Cisco IOS Release 12.3(11)T. The key and nonkey fields and the counters for the Flexible NetFlow "NetFlow IPv4 original output" predefined record are shown in the table below.

The configuration in the Example: Configuring Flexible NetFlow Egress Accounting for IPv4 and IPv6 Traffic uses the predefined Flexible NetFlow "NetFlow original output" record.

The key and nonkey fields and the counters for the Flexible NetFlow "NetFlow IPv6 original input" predefined record are shown in the table below.

The key and nonkey fields and the counters for the Flexible NetFlow "NetFlow IPv6 original output" predefined record are shown in the table below.

The Flexible NetFlow--MPLS Egress NetFlow feature allows you to capture IP flow information for packets that arrive on a router as Multiprotocol Label Switching (MPLS) packets and are transmitted as IP packets. This feature allows you to capture the MPLS VPN IP flows that are traveling through the service provider backbone from one site of a VPN to another site of the same VPN. The Flexible NetFlow--MPLS Egress NetFlow feature is enabled by applying a flow monitor in output (egress) mode on the provider edge (PE) to customer edge (CE) interface of the provider's network.

The figure below shows a sample MPLS VPN network topology that includes four VPN 1 sites and two VPN 2 sites. If the Flexible NetFlow--MPLS Egress NetFlow is enabled on an outgoing PE interface by applying a flow monitor in output mode, IP flow information for packets that arrive at the PE as MPLS packets (from an MPLS VPN) and that are transmitted as IP packets to the PE router is captured. For example:

• To capture the flow of traffic going to site 2 of VPN 1 from any remote VPN 1 sites, you enable a flow monitor in output mode on link PE2-CE5 of provider edge router PE2.
• To capture the flow of traffic going to site 1 of VPN 2 from any remote VPN 2 site, you enable a flow monitor in output mode on link PE3-CE4 of the provider edge router PE3.

The flow data is stored in the Flexible NetFlow cache. You can use the show flow monitor monitor-name cachecommand to display the flow data in the cache.

If you configure a Flexible NetFlow exporter for the flow monitors you use for the Flexible NetFlow-- MPLS Egress NetFlow feature, the PE routers will export the captured flows to the configured collector devices in the provider network. Applications such as the Network Data Analyzer or the VPN Solution Center (VPN-SC) can gather information from the captured flows and compute and display site-to-site VPN traffic statistics.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    flow monitor monitor-name

4.    description description

5.    record netflow {ipv4 | ipv6} original-input

6.    end

7.    show flow monitor [[name] monitor-name [cache [format {csv | record | table}]][statistics]]

8.    show running-config flow monitor monitor-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	flow monitor monitor-name Example: Device(config)# flow monitor FLOW-MONITOR-1	Creates a flow monitor and enters Flexible NetFlow flow monitor configuration mode. This command also allows you to modify an existing flow monitor.
Step 4	description description Example: Device(config-flow-monitor)# description Used for monitoring IPv4 traffic	(Optional) Creates a description for the flow monitor.
Step 5	record netflow {ipv4 | ipv6} original-input Example: Device(config-flow-monitor)# record netflow ipv4 original-input	Specifies the record for the flow monitor.
Step 6	end Example: Device(config-flow-monitor)# end	Exits Flexible NetFlow flow monitor configuration mode and returns to privileged EXEC mode.
Step 7	show flow monitor [[name] monitor-name [cache [format {csv | record | table}]][statistics]] Example: Device# show flow monitor FLOW-MONITOR-2 cache	(Optional) Displays the status and statistics for a Flexible NetFlow flow monitor.
Step 8	show running-config flow monitor monitor-name Example: Device# show flow monitor FLOW_MONITOR-1	(Optional) Displays the configuration of the specified flow monitor.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ip flow monitor monitor-name input

5.    end

6.    show flow interface type number

7.    show flow monitor name monitor-name cache format record

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface ethernet 0/0	Specifies an interface and enters interface configuration mode.
Step 4	ip flow monitor monitor-name input Example: Router(config-if)# ip flow monitor FLOW-MONITOR-1 input	Activates the flow monitor that you created previously by assigning it to the interface to analyze traffic.
Step 5	end Example: Router(config-if)# end	Exits interface configuration mode and returns to privileged EXEC mode.
Step 6	show flow interface type number Example: Router# show flow interface ethernet 0/0	Displays the status of Flexible NetFlow (enabled or disabled) on the specified interface.
Step 7	show flow monitor name monitor-name cache format record Example: Router# show flow monitor name FLOW_MONITOR-1 cache format record	Displays the status, statistics, and flow data in the cache for the specified flow monitor.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 flow monitor monitor-name input

5.    end

6.    show flow interface type number

7.    show flow monitor name monitor-name cache format record

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface ethernet 0/0	Specifies an interface and enters interface configuration mode.
Step 4	ipv6 flow monitor monitor-name input Example: Router(config-if)# ipv6 flow monitor FLOW-MONITOR-2 input	Activates the flow monitor that you created previously by assigning it to the interface to analyze traffic.
Step 5	end Example: Router(config-if)# end	Exits interface configuration mode and returns to privileged EXEC mode.
Step 6	show flow interface type number Example: Router# show flow interface ethernet 0/0	Displays the status of Flexible NetFlow (enabled or disabled) on the specified interface.
Step 7	show flow monitor name monitor-name cache format record Example: Router# show flow monitor name FLOW_MONITOR-1 cache format record	Displays the status, statistics, and flow data in the cache for the specified flow monitor.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    flow exporter exporter-name

4.    description description

5.    destination {hostname | ip-address} [vrf vrf-name]

6.    export-protocol {netflow-v5 | netflow-v9 | ipfix}

7.    transport udp udp-port

8.    exit

9.    flow monitor flow-monitor-name

10.    exporter exporter-name

11.    end

12.    show flow exporter exporter-name

13.    show running-config flow exporter exporter-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	flow exporter exporter-name Example: Device(config)# flow exporter EXPORTER-1	Creates a flow exporter and enters Flexible NetFlow flow exporter configuration mode. This command also allows you to modify an existing flow exporter.
Step 4	description description Example: Device(config-flow-exporter)# description Exports to datacenter	(Optional) Creates a description for the flow exporter.
Step 5	destination {hostname | ip-address} [vrf vrf-name] Example: Device(config-flow-exporter)# destination 172.16.10.2	Specifies the hostname or IP address of the system to which the exporter sends data. Note    You can export to a destination using either an IPv4 or IPv6 address.
Step 6	export-protocol {netflow-v5 | netflow-v9 | ipfix} Example: Device(config-flow-exporter)# export-protocol netflow-v9	Specifies the version of the NetFlow export protocol used by the exporter. Default: netflow-v9.
Step 7	transport udp udp-port Example: Device(config-flow-exporter)# transport udp 65	Configures UDP as the transport protocol and specifies the UDP port on which the destination system is listening for exported Flexible NetFlow traffic.
Step 8	exit Example: Device(config-flow-exporter)# exit	Exits Flexible NetFlow flow exporter configuration mode and returns to global configuration mode.
Step 9	flow monitor flow-monitor-name Example: Device(config)# flow monitor FLOW-MONITOR-1	Enters Flexible NetFlow flow monitor configuration mode for the flow monitor that you created previously.
Step 10	exporter exporter-name Example: Device(config-flow-monitor)# exporter EXPORTER-1	Specifies the name of an exporter that you created previously.
Step 11	end Example: Device(config-flow-monitor)# end	Exits Flexible NetFlow flow monitor configuration mode and returns to privileged EXEC mode.
Step 12	show flow exporter exporter-name Example: Device# show flow exporter FLOW_EXPORTER-1	(Optional) Displays the current status of the specified flow exporter.
Step 13	show running-config flow exporter exporter-name Example: Device<# show running-config flow exporter FLOW_EXPORTER-1	(Optional) Displays the configuration of the specified flow exporter.