Downloads |
Table Of Contents
MPLS Egress NetFlow Accounting
Related Features and Technologies
Supported Standards, MIBs, and RFCs
Enabling MPLS Egress NetFlow Accounting
Configuring NetFlow Aggregation Cache
Verifying MPLS Egress NetFlow Accounting Configuration
Monitoring and Maintaining MPLS Egress NetFlow Accounting
MPLS Egress NetFlow Accounting
This document describes the Cisco multiprotocol label switching (MPLS) egress NetFlow accounting feature. It identifies the supported platforms, provides configuration examples, and lists related IOS command line interface (CLI) commands.
This document includes the following major sections:
•
Supported Standards, MIBs, and RFCs
•
Feature Overview
The MPLS egress NetFlow accounting feature allows you to capture Internet Protocol (IP) flow information for packets undergoing MPLS label disposition; that is, packets that arrive on a router as MPLS and are transmitted as IP.
Previously, you captured NetFlow data only for flows that arrived on the packet in IP format. When an edge router performed MPLS label imposition (received an IP packet and transmitted it as an MPLS packet), NetFlow data was captured when the packet entered the network. Inside the network, the packet was switched based only on MPLS information, and thus NetFlow information was not captured until after the last label was removed.
One common application of the MPLS egress NetFlow accounting feature allows you to capture the MPLS virtual private network (VPN) IP flows that are traveling from one site of a VPN to another site of the same VPN through the service provider backbone.
Formerly, you captured flows only for IP packets on the ingress interface of a router. You could not capture flows for MPLS encapsulated frames, which were switched through Cisco Express Forwarding (CEF) from the input port. Therefore, in an MPLS VPN environment you captured flow information as packets were received from a customer edge (CE) router and forwarded to the backbone. However, you could not capture flow information as packets were transmitted to a CE router because those packets were received as MPLS frames.
The MPLS egress NetFlow accounting feature lets you capture the flows on the outgoing interfaces.
Figure 1 shows a sample topology. To capture the flow of traffic going to site 2 of VPN 1 from any remote VPN 1 sites, you enable MPLS egress NetFlow accounting on link PE2-CE5 of provider edge router PE2. The flows are stored in a global flow cache maintained by the router. You can use the show ip cache flow command or other aggregation flow commands to view the egress flow data.
Figure 1 Provider and Customer Networks with MPLS Egress NetFlow Accounting
The PE routers export the captured flows to the configured collector devices in the provider network. The NetFlow Analyzer or the VPN solution center (VPN-SC) application collects this information and computes and displays site-to-site VPN traffic statistics.
Benefits
Enhanced Network Monitoring for Complete Billing Solution
You can now capture flows on the egress and ingress router interfaces to provide complete end-to-end usage information on network traffic. The accounting server uses the collected data for various levels of aggregation for accounting reports and application programming interface (API) accounting information, thus providing a complete billing solution.
More Accurate Accounting Statistics
NetFlow data statistics now account for all the packets that are dropped in the core of the service provider network, thus providing more accurate traffic statistics and patterns.
Restrictions
Capturing Flows from Sites that Connect to the Same PE Router
The captured egress flows must originate from a different site of the same VPN, but they cannot connect to the same PE router. If both source and destination VPN sites are connected to the same PE router, the MPLS egress NetFlow accounting feature does not capture these flows unless the source and destination sites are connected to the PE router by separate physical interfaces. In this case, you can capture these flows by enabling ingress NetFlow on the incoming CE-PE link of the PE router. As shown in Figure 1, traffic from site 3 (VPN1 destined for site 2) is captured by an ingress NetFlow enabled on the PE2-CE3 link of PE2. If the source and destination sites are connected by the same physical interface, this feature will not capture the intended flow statistics.
Memory Impact
During times of heavy traffic, the additional flows can fill up the global flow hash table. If you need to increase the size of the global flow hash table, increase the memory of the router.
Performance Impact
MPLS egress NetFlow accounting might adversely affect network performance because of the additional accounting-related computation that occurs in the traffic-forwarding path of the router.
Related Features and Technologies
The MPLS egress NetFlow accounting feature is related to the MPLS VPNs and the NetFlow aggregation features. (See the section on "Related Documents.")
Related Documents
The following documents provide additional information:
•
•
•
•
Note
Supported Platforms
The MPLS egress NetFlow accounting feature supports the MPLS image on the following platforms:
•
•
•
•
•
–
Supported Standards, MIBs, and RFCs
Standards
The MPLS egress NetFlow accounting feature supports no new or modified standards.
MIBs
The MPLS egress NetFlow accounting feature supports no new or modified MIBs.
For descriptions of supported MIBs and how to use MIBs, see the Cisco MIB web site on CCO at http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml.
RFCs
•
•
•
•
Prerequisites
The network must support the following Cisco IOS features before you enable the MPLS egress NetFlow accounting feature:
•
•
Configuration Tasks
The configuration tasks for the MPLS egress NetFlow accounting feature are as follows:
•
•
Enabling MPLS Egress NetFlow Accounting
Router(config-if)# mpls netflow egress
Enables MPLS egress NetFlow accounting on the egress router interface.
Configuring NetFlow Aggregation Cache
Troubleshooting Tips
Use the following commands for troubleshooting the MPLS egress NetFlow accounting feature:
Note
Verifying MPLS Egress NetFlow Accounting Configuration
To verify MPLS egress NetFlow accounting configuration, use this procedure:
Step 1
Note
Router# show ip cache flowIP packet size distribution (10 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.000 .000 .000 1.00 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000IP Flow Switching Cache, 4456704 bytes1 active, 65535 inactive, 2 added26 ager polls, 0 flow alloc failureslast clearing of statistics neverProtocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)-------- Flows /Sec /Flow /Pkt /Sec /Flow /FlowICMP 1 0.0 5 100 0.0 0.0 15.7Total : 1 0.0 5 100 0.0 0.0 15.7SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP PktsEt1/1 34.0.0.2 Et1/4 180.1.1.2 01 0000 0800 5Table 1 describes the fields in the packet size distribution lines of the output.
Table 1 Command Field Descriptions—Packet Size
IP packet size distribution
The two lines below this banner show the percentage distribution of packets by size range.
Table 2 describes the fields in the flow switching cache lines of the output.
Table 3 describes the fields in the activity-by-protocol lines of the output.
Table 4 describes the fields in the current flow lines of the output.
Step 2
Router# show ip cache flow aggRouter# show ip cache flow aggregation prefRouter# show ip cache flow aggregation prefixIP Flow Switching Cache, 278544 bytes1 active, 4095 inactive, 1 added4 ager polls, 0 flow alloc failuresSrc If Src Prefix Msk Dst If Dst Prefix Msk Flows PktsEt1/1 34.0.0.0 /8 Et1/4 180.1.1.0 /24 1 5Router#Table 5 describes the fields in the flow switching cache lines of the output.
Table 6 describes the fields in the current flow lines of the output.
The ip flow-aggregation cache command has other options including:
{as | destination-prefix | prefix | protocol-port | source-prefix}
Note
Here is sample configuration output from the NetFlow aggregation cache:
Router(config)# ip flow-aggRouter(config)# ip flow-aggregation cacheRouter(config)# ip flow-aggregation cache ?as AS aggregationdestination-prefix Destination Prefix aggregationprefix Prefix aggregationprotocol-port Protocol and port aggregationsource-prefix Source Prefix aggregationRouter(config)# ip flow-aggregation cache prefixRouter(config-flow-cac)# enableHere is sample output displaying the IP aggregation cache contents:
Router# sh ip cache flow aggregation ?as AS aggregation cachedestination-prefix Destination Prefix aggregation cacheprefix Source/Destination Prefix aggregation cacheprotocol-port Protocol and port aggregation cachesource-prefix Source Prefix aggregation cacheRouter# sh ip cache flowIP packet size distribution (206 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.000 .854 .000 .145 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000IP Flow Switching Cache, 4292920 bytes0 active, 62977 inactive, 182 added2912 ager polls, 0 flow alloc failuresActive flows timeout in 30 minutesInactive flows timeout in 15 secondslast clearing of statistics neverProtocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)-------- Flows /Sec /Flow /Pkt /Sec /Flow /FlowICMP 182 0.0 1 62 0.0 0.0 15.5Total : 182 0.0 1 62 0.0 0.0 15.5SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP PktsRouter# sh ip cache flow aggrRouter# sh ip cache flow aggregation prRouter# sh ip cache flow aggregation preRouter# sh ip cache flow aggregation prefixIP Flow Switching Cache, 278544 bytes1 active, 4095 inactive, 3 added45 ager polls, 0 flow alloc failuresActive flows timeout in 30 minutesInactive flows timeout in 15 secondsSrc If Src Prefix Msk Dst If Dst Prefix Msk Flows PktsEt1/1 34.0.0.0 /8 PO6/0 12.12.12.12 /32 1 5Router#Monitoring and Maintaining MPLS Egress NetFlow Accounting
Configuration Examples
This section provides a configuration example for the MPLS egress NetFlow accounting feature.
In the following example, the VPN routing and forwarding (VRF) instances currently configured in the router display:
Router# sh ip vrfName Default RD Interfacesvpn1 100:1 Ethernet1/4Loopback1vpn3 300:1 Ethernet1/2Loopback2Router#Router# conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)# int eth1/4Router(config-if)# mpls ?ip Configure dynamic MPLS forwarding for IPlabel-protocol Configure label/tag distribution protocol (LDP/TDP)mtu Set tag switching Maximum Transmission Unitnetflow Configure Egress Netflow Accountingtraffic-eng Configure Traffic Engineering parametersRouter(config-if)# mpls netRouter(config-if)# mpls netflow ?egress Enable Egress Netflow AccountingMPLS egress NetFlow accounting is enabled on interface eth1/4 and debugging is turned on, as shown below:
Router(config-if)# mpls netflow egressRouter(config-if)#Router(config-if)#Router# debug mpls netflowMPLS Egress NetFlow debugging is onRouter#The following example shows the current configuration in the router:
Router# sh runBuilding configuration...Current configuration:!version 12.0service timestamps debug uptimeservice timestamps log uptimeno service password-encryptionip cefno ip domain-lookup!The VRF is defined, as shown below:
ip vrf vpn1rd 100:1route-target export 100:1route-target import 100:1!interface Loopback0ip address 41.41.41.41 255.255.255.255no ip directed-broadcastno ip mroute-cache!interface Ethernet1/4ip vrf forwarding vpn1ip address 180.1.1.1 255.255.255.0no ip directed-broadcastmpls netflow egress!Command Reference
This section describes the mpls netflow egress CLI command that you can use with the MPLS egress NetFlow accounting feature.
mpls netflow egress
To enable MPLS egress NetFlow accounting on an interface, use the mpls netflow egress interface configuration command. To disable MPLS egress NetFlow accounting, use the no form of this command.
mpls netflow egress
no mpls netflow egress
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
Interface configuration
Command History
12.0(10)ST
This command was introduced.
12.1(5)T
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
Use this command to configure the PE-CE interface of a PE router.
Examples
In the following example, MPLS egress NetFlow accounting is enabled on the egress PE interface that connects to the CE interface at the destination VPN site:
Router(config-if)# mpls netflow egressRelated Commands
Debug Commands
This section describes the new debug command, debug mpls netflow, which is related to the MPLS egress NetFlow accounting feature.
This section also describes the show mpls forwarding-table and show mpls interfaces commands, which you can use for debugging the MPLS egress NetFlow accounting feature.
debug mpls netflow
To display debug messages for MPLS egress NetFlow accounting, use the debug mpls netflow command.
[no] debug mpls netflow
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command History
12.0(10)ST
This command was introduced.
12.1(5)T
This command was integrated into Cisco IOS Release 12.1(5)T.
Examples
Here is sample output from the debug mpls netflow command:
Router#Router# debug mpls ?adjacency MPLS adjacency database eventsatm-cos MPLS Controlled ATM CoSatm-ldp MPLS ATM LDPevents MPLS eventsldp Label Distribution Protocollfib MPLS Forwarding Information Base servicesnetflow MPLS Egress NetFlow Accountingpackets MPLS packetstagcon MPLS/Tag control processtraffic-eng MPLS Traffic Engineering debugRouter# debug mpls netflowMPLS Egress NetFlow debugging is onRouter#Router#Router#4d00h:Egress flow:entry created, dest 3.3.3.3/32, src 34.0.0.1/8Router#Router#4d00h:Egress flow:entry created, dest 3.3.3.3/32, src 42.42.42.42/32Router# conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)# int eth1/4Router(config-if)# no mpls netflow egressRouter(config-if)#4d00h:MPLS output feature change, trigger TFIB scan4d00h:tfib_scanner_walk, prefix 5.5.5.5/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 2.0.0.0/8, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 3.3.3.3/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 40.40.40.40/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 50.50.50.50/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 100.100.100.100/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 180.1.1.0/24, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 190.1.1.0/24, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 2.0.0.0/8, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 4.4.4.4/32, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 40.40.40.40/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 50.50.50.50/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 177.1.1.0/24, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 180.1.1.0/24, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 190.1.1.0/24, rewrite flow flag 1Router(config-if)#Router(config-if)# mpls netflow egressRouter(config-if)#4d00h:Interface refcount with output feature enabled = 24d00h:MPLS output feature change, trigger TFIB scan4d00h:tfib_scanner_walk, prefix 5.5.5.5/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 2.0.0.0/8, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 3.3.3.3/32, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 40.40.40.40/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 50.50.50.50/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 100.100.100.100/32, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 180.1.1.0/24, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 190.1.1.0/24, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 2.0.0.0/8, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 4.4.4.4/32, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 40.40.40.40/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 50.50.50.50/32, rewrite flow flag 04d00h:tfib_scanner_walk, prefix 177.1.1.0/24, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 180.1.1.0/24, rewrite flow flag 14d00h:tfib_scanner_walk, prefix 190.1.1.0/24, rewrite flow flag 14d00h:Egress flow:entry created, dest 3.3.3.3/32, src 42.42.42.42/32Router(config-if)#Router(config-if)# endRouter# sh run int eth1/4Building configuration...Current configuration:!interface Ethernet1/4ip vrf forwarding vpn1ip address 180.1.1.1 255.255.255.0no ip directed-broadcastmpls netflow egressendRouter#Router#Router#4d00h:%SYS-5-CONFIG_I:Configured from console by consoleRouter#
Note
Related Commands
show mpls forwarding-table
To display the contents of the MPLS Label Forwarding Information Base (LFIB), use the show mpls forwarding-table EXEC command.
Note
show mpls forwarding-table [{network {mask | length} | labels label [- label] | interface interface | next-hop address | lsp-tunnel [tunnel-id]}] [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
EXEC
Command History
Examples
Note
The following example shows output from the show mpls forwarding-table detail command:
Router# show mpls forwarding-table detailLocal Outgoing Prefix Bytes tag Outgoing Next Hoptag tag or VC or Tunnel Id switched interface16 Aggregate 34.0.0.0/8[V] 0MAC/Encaps=0/0, MTU=0, Tag Stack{}VPN route: vpn1Feature Quick flag set
Note
Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 1517 Untagged 2.0.0.0/8[V] 0 Et0/0/2 34.0.0.1MAC/Encaps=0/0, MTU=1500, Tag Stack{}VPN route: vpn1Feature Quick flag setPer-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 1518 Untagged 42.42.42.42/32[V] 4185 Et0/0/2 34.0.0.1MAC/Encaps=0/0, MTU=1500, Tag Stack{}VPN route: vpn1Feature Quick flag setPer-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 1519 2/33 41.41.41.41/32 0 AT1/0/0.1 point2pointMAC/Encaps=4/8, MTU=4470, Tag Stack{2/33(vcd=2)}00028847 00002000No output feature configured
Note
Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 1520 Aggregate 39.39.39.39/32[V] 0Local Outgoing Prefix Bytes tag Outgoing Next Hoptag tag or VC or Tunnel Id switched interfaceMAC/Encaps=0/0, MTU=0, Tag Stack{}VPN route: vpn1No output feature configuredPer-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15Router#Table 7 describes the significant fields in the output from the show mpls forwarding-table detail command.
Related Commands
show mpls interfaces
To display the interfaces that have MPLS egress NetFlow accounting enabled, use the show mpls interfaces EXEC command with the internal keyword.
show mpls interfaces [type card/subcard/port | all] [detail] [internal]
Syntax Description
type
(Optional) Specifies one of the interface types listed in Table 8.
card/subcard /port
(Optional) Specifies the card, subcard, and port number of the ATM, ATM-P, CBR, Ethernet, or null interface.
all
(Optional) Displays all of the router's interfaces that have MPLS applications associated with them.
detail
(Optional) Displays detailed label switching information by interface.
internal
(Optional) Displays the value of the output_feature_state. If MPLS egress NetFlow accounting is enabled, output_feature_state is any number except 0. If MPLS egress NetFlow accounting is disabled, output_feature_state is 0.
Defaults
Displays label switching information for all interfaces.
Command Modes
EXEC
Command History
Usage Guidelines
You can show information about the requested interface or about all interfaces on which MPLS is enabled.
Table 8 describes each of the interface types used with the show mpls interfaces command.
Examples
The following sample output shows whether or not MPLS egress NetFlow accounting is enabled on the interface:
Router# show mpls interfaces internalInterface Ethernet0/0/1:IP tagging enabled (tdp)TSP Tunnel tagging not enabledTag Frame Relay Transport tagging not enabledTagging operationalIP to Tag Fast Feature Switching VectorTag Switching Turbo Feature VectorMTU = 1500, status=0x100043, appcount=1Output_feature_state=0x0
Note
Tag VPI = 1, Control VC = 0/32Interface Ethernet0/0/2:IP tagging enabled (tdp)TSP Tunnel tagging not enabledTag Frame Relay Transport tagging not enabledTagging operationalIP to Tag Fast Feature Switching VectorTag Switching Turbo Feature VectorMTU = 1500, status=0x100043, appcount=1Output_feature_state=0x1
Note
Tag VPI = 1, Control VC = 0/32Interface ATM1/0/0.1:IP tagging enabled (tdp)Related Commands
Glossary
BGP—Border Gateway Protocol. An interdomain routing protocol that replaces Exterior Border Gateway Protocol (EGP). BGP exchanges reachability information with other BGP systems. It is defined by RFC 1163.
Border Gateway Protocol—See BGP.
BGP/MPLS/VPN—A VPN solution that uses MPLS and BGP protocol to allow multiple remote customer sites to be connected over an IP backbone. Refer to RFC 2547 for details.
CE router—A customer edge router. A router that is part of a customer network and interfaces to a PE router.
customer network—A network that is under the control of an end customer. A customer network can use private addresses as defined in RFC 1918. Customer networks are logically isolated from each other and from the provider network. A customer network is also known as a C network.
egress PE—The provider edge router through which traffic moves from the backbone to the destination VPN site.
flow—A set of packets with the same source IP address, destination IP address, source/destination ports, and type-of-service, and the same interface on which flow is monitored. Ingress flows are associated with the input interface, and egress flows are associated with the output interface.
ingress PE—The provider edge router through which traffic enters the backbone (provider network) from a VPN site.
label—A short, fixed length identifier that tells switching nodes how the data (packets or cells) should be forwarded.
MPLS—Multiprotocol label switching. An emerging industry standard on which label switching is based.
multiprotocol label switching—See MPLS.
open shortest path first—See OSPF.
OSPF—Open Shortest Path First. A link-state, hierarchical Interior Gateway Protocol (IGP) routing algorithm proposed as a successor to RIP in the Internet community. OSPF features include least-cost routing, multipath routing, and load balancing.
PE router—A provider edge router. A router at the edge of a provider network that interfaces to CE routers.
provider network—A backbone network that is under the control of a service provider and provides transport among customer sites. A provider network is also known as the P network.
virtual private network—See VPN.
VPN—Virtual private network. A network that enables IP traffic to use tunneling to travel securely over a public TCP/IP network.
VRF—VPN routing and forwarding instance. The VRF is a key element in the MPLS VPN technology. VRFs exist on PEs only. A VRF is populated with VPN routes and allows multiple routing tables in a PE. One VRF is required per VPN on each PE in the VPN.
