Configuring MPLS Egress NetFlow Accounting and Analysis

The MPLS Egress NetFlow Accounting feature allows you to capture IP flow information for packets that arrive on a router as MPLS packets and are transmitted as IP packets.

This feature allows you to capture the MPLS Virtual Private Network (VPN) IP flows that are traveling through the service provider backbone from one site of a VPN to another site of the same VPN.

Formerly, you could capture flows only for IP packets on the ingress interface of a router. You could not capture flows for MPLS encapsulated frames, which were switched through CEF from the input port. Therefore, in an MPLS VPN environment, you captured flow information when packets were received from a customer edge (CE) router and forwarded to the backbone. However, you could not capture flow information when packets were transmitted to a CE router because those packets were received as MPLS frames.

The MPLS Egress NetFlow Accounting feature lets you capture the flows on the outgoing interfaces.

The figure below shows a sample MPLS VPN network topology that includes four VPN 1 sites and two VPN 2 sites. If MPLS egress NetFlow is enabled on an outgoing PE interface, you can capture IP flow information for packets that arrive at the PE as MPLS packets (from an MPLS VPN) and that are transmitted as IP packets. For example,

• To capture the flow of traffic going to site 2 of VPN 1 from any remote VPN 1 sites, you enable MPLS egress NetFlow on link PE2-CE5 of provider edge router PE2.
• To capture the flow of traffic going to site 1 of VPN 2 from any remote VPN 2 site, you enable MPLS egress NetFlow on link PE3-CE4 of the provider edge router PE3.

The flows are stored in a global flow cache maintained by the router. You can use the show ip cache flow command or other aggregation flow commands to view the egress flow data.

Figure 1

Sample MPLS VPN Network Topology with MPLS Egress NetFlow Accounting

The PE routers export the captured flows to the configured collector devices in the provider network. Applications such as the Network Data Analyzer or the VPN Solution Center (VPN-SC) can gather information from the captured flows and compute and display site-to-site VPN traffic statistics.

1.    enable

2.    configure terminal

3.    interface interface-type interface-number

4.    mpls netflow egress

5.    end

• Troubleshooting Tips
  

1.    show ip cache flow

2.    show mpls forwarding-table detail

3.    show mpls interfaces internal

Router# show ip cache flow
IP packet size distribution (10 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .000 .000 1.00 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 4456704 bytes
  1 active, 65535 inactive, 2 added
  26 ager polls, 0 flow alloc failures
  Active flows timeout in 30 minutes
  Inactive flows timeout in 15 seconds
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
ICMP                 1      0.0         5   100      0.0       0.0      15.7
Total :              1      0.0         5   100      0.0       0.0      15.7
SrcIf         SrcIPaddress    DstIf         DstIPaddress 	Pr SrcP DstP  Pkts
Et1/1         209.165.200.225 Et1/4         209.165.201.2 	01 0000 0800     5

Router# show mpls forwarding-table detail
Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop
tag    tag or VC   or Tunnel Id      switched   interface
16     Aggregate   34.0.0.0/8[V]     0
        MAC/Encaps=0/0, MTU=0, Tag Stack{}
        VPN route: vpn1
        Feature Quick flag set

Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 
17     Untagged    2.0.0.0/8[V]      0          Et0/0/2    34.0.0.1
        MAC/Encaps=0/0, MTU=1500, Tag Stack{}
        VPN route: vpn1
        Feature Quick flag set
Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
18     Untagged    42.42.42.42/32[V] 4185       Et0/0/2    34.0.0.1
        MAC/Encaps=0/0, MTU=1500, Tag Stack{}
        VPN route: vpn1
        Feature Quick flag set
Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
19     2/33        41.41.41.41/32    0          AT1/0/0.1  point2point
        MAC/Encaps=4/8, MTU=4470, Tag Stack{2/33(vcd=2)}
        00028847 00002000
        No output feature configured

Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
20     Aggregate   39.39.39.39/32[V] 0
Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop
tag    tag or VC   or Tunnel Id      switched   interface
        MAC/Encaps=0/0, MTU=0, Tag Stack{}
        VPN route: vpn1
        No output feature configured
Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Router#

Router# show mpls interfaces internal
Interface Ethernet0/0/1:
        IP tagging enabled (tdp)
        TSP Tunnel tagging not enabled
        Tag Frame Relay Transport tagging not enabled
        Tagging operational
        IP to Tag Fast Feature Switching Vector
Tag Switching Turbo Feature Vector
        MTU = 1500, status=0x100043, appcount=1
        Output_feature_state=0x0
 

Tag VPI = 1, Control VC = 0/32
Interface Ethernet0/0/2: 
        IP tagging enabled (tdp)
        TSP Tunnel tagging not enabled
        Tag Frame Relay Transport tagging not enabled
        Tagging operational
        IP to Tag Fast Feature Switching Vector
        Tag Switching Turbo Feature Vector
        MTU = 1500, status=0x100043, appcount=1
        Output_feature_state=0x1
 

Tag VPI = 1, Control VC = 0/32
Interface ATM1/0/0.1:
        IP tagging enabled (tdp)

This section contains a sample configuration for the MPLS Egress NetFlow Accounting feature.

The show ip vrfcommand lists the Virtual Private Network (VPN) routing and forwarding instances (VRFs) configured in the router:

Router# show ip vrf
  Name                             Default RD          Interfaces
  vpn1                             100:1               Ethernet1/4
                                                       Loopback1
  vpn3                             300:1               Ethernet1/2
                                                       Loopback2

In the following example, MPLS Egress NetFlow Accounting is enabled on interface Ethernet 1/4:

configure terminal
!
interface ethernet 1/4
 ip address 172.17.24.2 255.255.255.0
 mpls netflow egress
 exit

Enter the show running-configcommand to view the current configuration in the router:

Router# show running-config
Building configuration...
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
ip cef
no ip domain-lookup
!

This section of the output shows the VRF being defined and shows that the MPLS Egress NetFlow Accounting feature is enabled:

ip vrf vpn1
 rd 100:1
 route-target export 100:1
 route-target import 100:1
!
interface Loopback0
 ip address 10.41.41.41 255.255.255.255
 no ip directed-broadcast
 no ip mroute-cache
!
interface Ethernet1/4
 ip vrf forwarding vpn1
 ip address 172.17.24.2 255.255.255.0
 no ip directed-broadcast
 mpls netflow egress
!