Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Flexible NetFlow
The following are prerequisites for your Flexible NetFlow configuration:
You must configure a source interface. If you do not configure a source interface, the exporter will remain in a disabled state.
You must configure a valid record name for every flow monitor.
The following are the prerequisites for wireless Flexible NetFlow:
Ensure that the networking device is running a Cisco release that supports wireless Flexible NetFlow.
Ensure that the target is connected to a WLAN.
The networking device must be configured to support protocol types such as IP, IPv6, and datalink.
Valid flow record and monitor are required before generating the flow.
Restrictions for Flexible NetFlow
The following are restrictions for Flexible NetFlow:
Traditional NetFlow (TNF) accounting is not supported.
Flexible NetFlow v5 export format is not supported, only NetFlow v9 export format is supported.
Both ingress and egress NetFlow accounting is supported.
Microflow policing feature shares the NetFlow hardware resource with FNF.
Only one flow monitor per interface and per direction is supported.
Layer 2, IPv4, and IPv6 traffic types are supported; however, the controller can apply a flow monitor to only one of these types at a time for a given direction and interface.
Layer 2, VLAN, and Layer 3 interfaces are supported, but the controller does not support SVI and tunnels.
The following NetFlow table sizes are supported:
Ingress NetFlow Table
Egress NetFlow Table
The controller supports three ASICs and each ASIC has 8K and 16K entries.
The NetFlow tables are on separate compartments and cannot be combined. Depending on which ASIC processed the packet, the flows will be created in the table in the corresponding ASIC.
Both full flow accounting and sampled NetFlow accounting are supported.
NetFlow hardware implementation supports four hardware samplers. You can select a sampler rate from 1 out of 2 to 1 out of 1024. Only random sampling mode is supported.
With the microflow policing feature (which is enabled only for wireless implementation), NetFlow can and should be used only in full flow mode i.e. NetFlow policing cannot be used. For wireless traffic, applying a sampler is not permitted, as it
Only full flow accounting is supported for wireless traffic.
NetFlow hardware uses hash tables internally. Hash collisions can occur in the hardware. Therefore, in spite of the internal overflow Content Addressable Memory (CAM), the actual NetFlow table utilization could be about 80 percent.
Depending on what fields are used for the flow, a single flow could take two consecutive entries. IPv6 flows also take two entries. In these situations, the effective usage of NetFlow entries is half the table size, which is separate from the above hash collision limitation.
The controller supports up to 16 flow monitors.
Microflow policing uses a separate set of flow monitors (limit 3).
SSID-based NetFlow accounting is supported. SSID is treated in a manner similar to an interface. However, certain fields are not supported (such as AP MAC address and user ID ).
NetFlow v9 format NetFlow export is supported.
Ingress flows are present in the ASIC that first received the packets for the flow. Egress flows are present in the ASIC from which the packets actually left the controller set up.
The reported value for the bytes count field (called “bytes long”) is Layer-2-packet-size—18 bytes. For classic Ethernet traffic (802.3), this will be accurate. For all other Ethernet types, this field will not be accurate. Use the "bytes layer2” field, which always reports the accurate Layer 2 packet size.
For information about supported Flexible NetFlow fields, see Supported Flexible NetFlow Fields.
Information About Flexible NetFlow
NetFlow is a Cisco technology that provides statistics on packets flowing through the controller. NetFlow is the standard for acquiring IP operational data from IP networks. NetFlow provides data to enable network and security monitoring, network planning, traffic analysis, and IP accounting. Flexible NetFlow improves on original NetFlow by adding the capability to customize the traffic analysis parameters for your specific requirements. Flexible NetFlow facilitates the creation of more complex configurations for traffic analysis and data export through the use of reusable configuration components.
Flexible NetFlow uses flows to provide statistics for accounting, network monitoring, and network planning.
A flow is a unidirectional stream of packets that arrives on a source interface and has the same values for the keys. A key is an identified value for a field within the packet. You create a flow using a flow record to define the unique keys for your flow.
The controller supports the Flexible NetFlow feature that enables enhanced network anomalies and security detection. Flexible NetFlow allows you to define an optimal flow record for a particular application by selecting the keys from a large collection of predefined fields.
All key values must match for the packet to count in a given flow. A flow might gather other fields of interest, depending on the export record version that you configure. Flows are stored in the Flexible NetFlow cache.
You can export the data that Flexible NetFlow gathers for your flow by using an exporter and export this data to a remote Flexible NetFlow collector.
You define the size of the data that you want to collect for a flow using a monitor. The monitor combines the flow record and exporter with the Flexible NetFlow cache information.
The wireless Flexible NetFlow infrastructure supports the following:
Flexible NetFlow Version 9.0
User-based rate limiting
Voice and video flow monitoring
Reflexive access control list (ACL)
Microflow Policing and User-Based Rate Limiting
Microflow policing associates a 2-color 1-rate policer and related drop statistics to each flow present in the NetFlow table. When the flow mask comprises all packet fields, this functionality is known as microflow policing. When the flow mask comprises either source or destination only, this functionality is known as user-based rate limiting.
Voice and Video Flow Monitoring
Voice and video flows are full flow mask-based entries. The ASIC provides the flexibility to program the policer parameters, share policers across multiple flows and rewrite the IP address and Layer 4 port numbers of these flows.
For dynamic entries, the NetFlow engine will use the policer parameters that are derived for the flow based on the policy (ACL/QoS-based policies). Dynamic entries cannot share policer across multiple flows.
Reflexive ACLs allow IP packets to be filtered based on upper-layer session information. The ACLs allow outbound traffic and limit inbound traffic in response to the sessions that originate inside the trusted network. The reflexive ACLs are transparent to the filtering mechanism until a data packet that matches the reflexive entry activates it. At this time, a temporary ACL entry is created and added to the IP-named access lists. The information obtained from the data packet to generate the reflexive ACL entry is permit/deny bit, the source IP address and port, the destination IP address, port, and the protocol type. During reflexive ACL entry evaluation, if the protocol type is either TCP or UDP, then the port information must match exactly. For other protocols, there is no port information to match. After this ACL is installed, the firewall is then opened for the reply packets to pass through. At this time, a potential hacker could have access to the network behind the firewall. To narrow this window, an idle timeout period can be defined. However, in the case of TCP, if two FIN bits or an RST is detected, the ACL entry can be removed.
A flow record defines the keys that Flexible NetFlow uses to identify packets in the flow, as well as other fields of interest that Flexible NetFlow gathers for the flow. You can define a flow record with any combination of keys and fields of interest. The controller supports a rich set of keys. A flow record also defines the types of counters gathered per flow. You can configure 64-bit packet or byte counters. The controller enables the following match fields as the defaults when you create a flow record:
The controller exports data to the collector whenever a timeout occurs or when the flow is terminated (TCP Fin or Rst received, for example). You can configure the following timers to force a flow export:
Active timeout—The flow continues to have the packets for the past m seconds since
the flow was created.
Inactive timeout—The flow does not have any packets for the past n seconds.
The commands in the following table can be used to monitor Flexible NetFlow.
Table 5 Flexible NetFlow Monitoring Commands
show flow exporter [broker | export-ids | name | name | statistics | templates]
Displays information about NetFlow flow exporters and statistics.
show flow exporter [ nameexporter-name]
Displays information about NetFlow flow exporters and statistics.
show flow interface
Displays information about NetFlow interfaces.
show flow monitor [ nameexporter-name]
Displays information about NetFlow flow monitors and statistics.
show flow record [ namerecord-name]
Displays information about NetFlow flow records.
show flow ssid
Displays NetFlow monitor installation status for a WLAN.
show sampler [broker | name | name]
Displays information about NetFlow samplers.
Displays the WLAN configured on the device.
Configuration Examples for Flexible NetFlow
Example: Configuring a Flow
This example shows how to create a flow and apply it to an interface:
Controller# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Controller(config)# flow export export1Controller(config-flow-exporter)# destination 10.0.101.254Controller(config-flow-exporter)# transport udp 2055Controller(config-flow-exporter)# exitController(config)# flow record record1Controller(config-flow-record)# match ipv4 source addressController(config-flow-record)# match ipv4 destination addressController(config-flow-record)# match ipv4 protocolController(config-flow-record)# match transport source-portController(config-flow-record)# match transport destination-portController(config-flow-record)# collect counter byte longController(config-flow-record)# collect counter packet longController(config-flow-record)# collect timestamp absolute firstController(config-flow-record)# collect timestamp absolute lastController(config-flow-record)# exitController(config)# flow monitor monitor1Controller(config-flow-monitor)# record record1Controller(config-flow-monitor)# exporter export1Controller(config-flow-monitor)# exitController(config)# interface tenGigabitEthernet 1/0/1Controller(config-if)# ip flow monitor monitor1 inputController(config-if)# end
Example: Configuring IPv4 Flexible NetFlow in WLAN (Ingress Direction)
The following example shows how to configure IPv4 Flexible NetFlow on WLAN ingress direction:
Controller# configure terminalController(config)# flow record fr_v4Controller(config-flow-record)# match ipv4 destinationController(config-flow-record)# match ipv4 sourceController(config-flow-record)# match ipv4 protocolController(config-flow-record)# match ipv4 tosController(config-flow-record)# match ipv4 ttlController(config-flow-record)# match ipv4 versionController(config-flow-record)# collect counter packets longController(config-flow-record)# collect counter bytes longController(config-flow-record)# collect timestamp sys-uptime firstController(config-flow-record)# collect timestamp sys-uptime lastController(config-flow-record)# exitController(config)# flow monitor fm_v4Controller(config-flow-monitor)# record fr_v4Controller(config-flow-record)# exitController(config)# wlan 1Controller(config-wlan)# ip flow monitor fm_v4 inController(config-wlan)# endController# show flow monitor fm_v4 cache
The Cisco Support website provides extensive online resources,
including documentation and tools for troubleshooting and
resolving technical issues with Cisco products and technologies.
To receive security and technical information about your
products, you can subscribe to various services, such as the
Product Alert Tool (accessed from Field Notices), the Cisco
Technical Services Newsletter, and Really Simple Syndication
Access to most tools on the Cisco Support website requires a
Cisco.com user ID and password.