Configure traffic flow monitoring | Traffic Flow Monitoring | Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

Describes how to configure traffic flow monitoring on Cisco devices. Provides detailed information and procedures for setting up monitoring capabilities to track and analyze network traffic patterns.

The following sections provide information about configuring traffic flow monitoring.

Configure traffic flow monitoring on Cisco IOS XE Catalyst SD-WAN devices using policy groups

Use this task to enable flow visibility and application visibility for IPv4 and IPv6 traffic on Cisco IOS XE Catalyst SD-WAN devices within a configuration group to monitor network traffic patterns.

Before you begin

A policy group must be created.
Ensure that you have configured Cflowd collector details in the Cisco SD-WAN Manager menu from Configuration > Network Hierarchy > Collectors > Cflowd.

Note

The Cflowd configuration applies to the global level and not the site level.

The additional settings that you configure are applied to the Cisco SD-WAN Controllers while deploying the application priority and SLA policy. For more information about configuring Cflowd, see the section Configure Cflowd in Configure Collectors in a Network Hierarchy.
If you require manual configuration or are using a release that does not support the Policy Group method, use the CLI Add-on Profile method. For more information, refer to CLI Add-On Profile.

Follow these steps to traffic flow monitoring using a policy group:

Before you begin

Follow these steps to configure traffic flow monitoring on using policy groups:

Procedure

From the Cisco SD-WAN Manager menu, choose Configuration > Policy Groups.

Select the desired policy group and click Edit.

Click Application Priority and SLA.

Click Add Traffic Policy or select an existing policy to edit.

Click Additional Settings to monitor traffic flow on incoming packets in the LAN for application and flow visibility over IPv4, IPv6, or both network addresses.

Enable traffic flow monitoring:

From Cisco Catalyst SD-WAN Manager Release 20.13.x, the configuration for Flow Visibility and Application Visibility, and Cflowd policy is available under Additional Settings .

Table 1. Additional Settings
Field	Description
Application Visibility	Monitor all the applications running in all VPNs over IPv4, IPv6, or both networks in the LAN.
Flow Visibility	Monitor traffic flow over IPv4, IPv6, or both network addresses in the LAN.

Click Save.

The flow visibility and application visibility configurations are saved to the policy group and are ready to be applied to the target devices.

What to do next

Deploy the policy group to the target devices to push the visibility settings to the network. For more information, Deploy Policy Group Workflow..

Configure traffic flow monitoring on Cisco IOS XE Catalyst SD-WAN devices using classic policies

This task enables you to set up Cflowd traffic flow monitoring on Cisco IOS XE Catalyst SD-WAN devices using classic policies.

Cflowd traffic flow monitoring uses Flexible NetFlow (FNF) to export traffic data from your network devices. This configuration is performed using classic policies on Cisco IOS XE Catalyst SD-WAN devices.

Procedure

Perform the following steps to configure Cflowd monitoring.

Traffic flow monitoring with Cflowd is configured on your Cisco IOS XE Catalyst SD-WAN device, and traffic data will be exported using Flexible NetFlow.

Configure global flow visibility

Enable Cflowd visibility globally on all Cisco IOS XE Catalyst SD-WAN devices so that you can perform traffic flowing monitoring on traffic coming to the router from all VPNs in the LAN.

Flow visibility enables monitoring of network traffic flows using Cflowd technology. This configuration allows you to monitor both IPv4 and IPv6 traffic flows across your SD-WAN network.

Procedure

	1.	From the Cisco SD-WAN Manager menu, choose Configuration > Policies.
	2.	Click Localized Policy.
	3.	Click Add Policy.
	4.	Click Next to advance through the wizard pages until you reach Policy Overview and then the Policy Settings page.
	5.	Enter Policy Name and Policy Description.
	6.	Check the Netflow check box to enable flow visibility for IPv4 traffic.
	7.	Check the Netflow IPv6 check box to enable flow visibility for IPv6 traffic. Note Enable flow visibility for IPv4 and IPv6 traffic before configuring Cflowd traffic flows with SAIE visibility. For more information on monitoring Cflowd and SAIE flows, see the Devices and Controllers chapter of the Cisco Catalyst SD-WAN Monitor and Maintain Configuration Guide.
	8.	Check Implicit ACL Logging to configure your Cisco IOS XE Catalyst SD-WAN device to log dropped packets in the traffic. With this configuration, you have visibility of the packets dropped by implicit access control lists (ACL) in case of a link failure in the system.
	9.	Enter Log Frequency. Log frequency determines how often packet flows are logged. Maximum value is 2147483647. It is rounded down to the nearest power of 2. For example, for 1000, the logging frequency is 512. Thus, every 512th packet in the flow is logged.
	10.	Enter FNF IPv4 Max Cache Entries to configure FNF cache size for IPv4 traffic. For example, enter 100 to configure FNF cache for IPv4/IPv6 traffic as shown in the following example. Note Starting with Cisco SD-WAN Release 26.1.1, the FNF default cache size changes automatically based on the length of the defined FNF flow. For example, if you enable more optional features, the FNF default cache size decreases.
	11.	Enter FNF IPv6 Max Cache Entries to configure FNF cache size for IPv6 traffic. For example, enter 100 to configure FNF cache for IPv4/IPv6 traffic as shown in the following example. Note The minimum cache size value is 16. The maximum of total cache size (IPv4 cache + IPv6 cache) should not exceed the limit for each platform. If cache size is not defined and the platform is not in the list, then default maximum cache entries is 200k.

The maximum cache entries is the maximum concurrent flows that Cflowd can monitor. The maximum cache entries vary on different platforms. For more information, contact Cisco Support.

The following example shows the flow-visibility configuration for both IPv4 and IPv6:

policy
    flow-visibility 
    implicit-acl-logging
    log-frequency 1000
    flow-visibility-ipv6
    ip visibility cache entries 100
    ipv6 visibility cache entries 100

While running policy flow-visibility or app-visibility to enable the FNF monitor, you may see the following warning message displaying a GLOBAL memory allocation failure. This log is triggered by enabling FNF monitoring (policy flow-visibility or app-visibility ) with a large cache size.

Jul  4 01:45:00.255: %CPPEXMEM-3-NOMEM: F0/0: cpp_cp_svr: QFP: 0, GLOBAL memory allocation of 90120448 bytes by FNF failed
Jul  4 01:45:00.258: %CPPEXMEM-3-TOPUSER: F0/0: cpp_cp_svr: QFP: 0, Top User: CPR STILE EXMEM GRAPH, Allocations: 877, Type: GLOBAL
Jul  4 01:45:00.258: %CPPEXMEM-3-TOPUSER: F0/0: cpp_cp_svr: QFP: 0, Top User: SBC, Bytes Allocated: 53850112, Type: GLOBAL

The warning message does not necessarily indicate a flow monitor application failure. The warning message can indicate internal steps that FNF uses for applying memory from the External Memory Manager (EXMEM) infrastructure.

Use the show platform hardware qfp active classification feature-manager EXMEM-usage command to display the EXMEM memory usage for various clients.

Device# show platform hardware qfp active classification feature-manager exmem-usage

EXMEM Usage Information

Total exmem used by CACE: 39668

Client       Id   Total VMR     Total Usage   Total%   Alloc     Free 
---------------------------------------------------------------------------
acl          0      11           2456          6         88       84         
qos          2     205          31512         79          7        5          
fw           4       8            892          2          2        1          
obj-group   39      82           4808         12          5        2

To ensure that the FNF monitor is enabled successfully, use the show flow monitor monitor-name command to check the status (allocated or not allocated ) of a flow monitor.

Device# show flow monitor sdwan_flow_monitor
Flow Monitor sdwan_flow_monitor:
  Description:       monitor flows for vManage and external collectors
  Flow Record:       sdwan_flow_record-003
  Flow Exporter:     sdwan_flow_exporter_1
                     sdwan_flow_exporter_0
  Cache:
    Type:                 normal (Platform cache)
    Status:               allocated
    Size:                 250000 entries
    Inactive Timeout:     10 secs
    Active Timeout:       60 secs

    Trans end aging:   off

SUCCESS
   Status:            allocated
FAILURE
   Status:            not allocated

Configure global flow visibility using configuration groups

Enable Cflowd visibility globally on all Cisco IOS XE Catalyst SD-WAN devices to perform traffic flow monitoring for traffic originating from all VPNs in the LAN.

Before you begin

Follow these steps to configure global flow visibility:

Procedure

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

Click Transport & Management Profile.
Select the desired transport profile and click Edit.
Click Edit Ethernet Interface > Tunnel.
Enable Allow Fragmentation and MTU To Max.
Click Save.

What to do next

Configure global application visibility

Enable Cflowd visibility globally on all Cisco IOS XE Catalyst SD-WAN devices so that you can perform traffic flowing monitoring on traffic coming to the router from all VPNs in the LAN.

The app-visibility enables nbar to see each application of the flows coming to the router from all VPNs in the LAN. If app-visibility or app-visibility-ipv6 is defined, then nbar is enabled globally for both IPv4 and IPv6 flows.

Procedure

	1.	From the Cisco SD-WAN Manager menu, choose Configuration > Policies.
	2.	Click Localized Policy.
	3.	Click Add Policy.
	4.	Click Next to advance through the wizard pages until you reach Policy Overview and then the Policy Settings page.
	5.	Enter Policy Name and Policy Description.
	6.	Check the Application check box to enable application visibility for IPv4 traffic.
	7.	Check the Application IPv6 check box to enable application visibility for IPv6 traffic. Note Enable application visibility for IPv4 and IPv6 traffic before configuring Cflowd traffic flows with SAIE visibility. For more information on monitoring Cflowd and SAIE flows, see the Devices and Controllers chapter of the Cisco Catalyst SD-WAN Monitor and Maintain Configuration Guide.
	8.	Enter FNF IPv4 Max Cache Entries to configure FNF cache size for IPv4 traffic. For example, enter 100 to configure FNF cache size for IPv4 traffic as shown in the following example.
	9.	Enter FNF IPv6 Max Cache Entries to configure FNF cache size for IPv6 traffic. For example, enter 100 to configure FNF cache size for IPv6 traffic as shown in the following example.

The following example shows the application visibility configuration for both IPv4 and IPv6:

policy
 app-visibility 
  
 
 app-visibility-ipv6  
 ip visibility cache entries 100
 ipv6 visibility cache entries 100
!

Note

The policy app-visibility command also enables global flow visibility by enabling nbar to get the application name.

Note

If you configure Cflowd global flow-visibility, but you do not configure Cflowd app-visibility, the exported application to Cisco SD-WAN Manager returns a result of unknown. The same application exported to an external collector using the IPFIX analyzer may contain an incorrect application name.

If you want to retain the application name, define Cflowd app-visibility to avoid this issue.

Configure a Cflowd monitoring policy

Configure a policy for Cflowd traffic flow monitoring to enable network traffic analysis and monitoring capabilities in your SD-WAN environment.

To configure a policy for Cflowd traffic flow monitoring, use the Cisco SD-WAN Manager policy configuration wizard. The wizard consists of four sequential pages that guide you through the process of creating and editing policy components:

Create Applications or Groups of Interest: Create lists that group related items together and that you call in the match or action components of a policy.
Configure Topology: Create the network structure to which the policy applies.
Configure Traffic Rules: Create the match and action conditions of a policy.
Apply Policies to Sites and VPNs: Associate a policy with sites and VPNs in the overlay network.

In the first three policy configuration wizard pages, create policy components or blocks. In the last page, apply policy blocks to sites and VPNs in the overlay network. For the Cflowd policy to take effect, activate the policy.

Procedure

	1.	From the Cisco SD-WAN Manager menu, choose Configuration > Policies.
	2.	Click Custom Options.
	3.	Under Centralized Policy, click Traffic Policy.
	4.	Click Cflowd.
	5.	Click Add Policy and then click Create New.
	6.	Enter the Name and Description for the policy.
	7.	In the Cflowd Template section, enter Active Flow Timeout.
	8.	In the Inactive Flow Timeout field, enter the timeout range.
	9.	In the Flow Refresh field, enter the range.
	10.	In the Sampling Interval field, enter the sample duration.
	11.	In the Protocol drop-down list, choose an option from the drop-down list. Starting from Cisco IOS XE Catalyst SD-WAN Release 17.6.1a and Cisco vManage Release 20.6.1, the Advanced Settings field displays when you choose IPv4 or Both from the options.
	12.	Under the Advanced Settings, do the following to collect additional IPv4 flow records: Check the TOS check box. Check the Re-marked DSCP check box.
	13.	Under the Collector List, click New Collector. You can configure up to four collectors. In the VPN ID field, enter the number of the VPN in which the collector is located. In the IP Address field, enter the IP address of the collector. In the Port field, enter the collector port number. In the Transport Protocol drop-down list, choose the transport type to use to reach the collector. In the Source Interface field, enter the name of the interface to use to send flows to the collector. In the Export Spreading field, click the Enable or Disable radio button. Starting from Cisco IOS XE Catalyst SD-WAN Release 17.9.1a and Cisco vManage Release 20.9.1, the Export Spreading option is supported for cEdge devices only. Export spreading distributes the export of flow records over time to reduce the burst effect. This helps prevent situations where a large number of flows expire simultaneously and are exported at the same time, which can overwhelm the collector or cause network congestion. The default is Disable. To enable BFD metrics export, in the BFD Metrics Export field, click Enable. Starting from Cisco IOS XE Catalyst SD-WAN Release 17.10.1a and Cisco vManage Release 20.10.1, BFD metrics export is supported for cEdge devices only. BFD metrics export provides additional information about the Bidirectional Forwarding Detection sessions and their associated metrics. The default is Disable. In the Exporting Interval field, enter the export interval in seconds for sending the BFD metrics to an external collector. Enter an integer value. This field is displayed only if you enable BFD metrics export. The default BFD export interval is 600 seconds.
	14.	Click Save Cflowd Policy.

View cflowd information

To view Cflowd information, use the commands on the Cisco IOS XE Catalyst SD-WAN device.

Available commands

show sdwan app-fwd cflowd collector
show sdwan app-fwd cflowd flow-count
show sdwan app-fwd cflowd flows [vpn vpn-id] format table
show sdwan app-fwd cflowd statistics
show sdwan app-fwd cflowd template [name template-name]
show sdwan app-fwd cflowd flows format table

Note

Starting from Cisco IOS XE Catalyst SD-WAN Release 17.15.1a, the preceding show commands retrieve up to 4000 flow records for each monitor (IPv4 and IPv6) from the cflowd database. The flow records exceeding 4000 are not shown.

Sample output

This sample output displays Cflowd information:

Device# show sdwan app-fwd cflowd flows 
Generating output, this might take time, please wait ...
app-fwd cflowd flows vpn 1 src-ip 10.2.2.11 dest-ip 10.20.24.17 src-port 0 dest-port 2048 dscp 63 ip-proto 1
 tcp-cntrl-bits           0
 icmp-opcode              2048
 total-pkts               6
 total-bytes              600
 start-time               "Fri May 14 02:57:23 2021"
 egress-intf-name         GigabitEthernet5
 ingress-intf-name        GigabitEthernet1
 application              unknown
 family                   network-service
 drop-cause               "No Drop"
 drop-octets              0
 drop-packets             0
 sla-not-met              0
 color-not-met            0
 queue-id                 2
 tos                      255
 dscp-output              63
 sampler-id               3
 fec-d-pkts               0
 fec-r-pkts               0
 pkt-dup-d-pkts-orig      0
 pkt-dup-d-pkts-dup       0
 pkt-dup-r-pkts           0
 pkt-cxp-d-pkts           0
 traffic-category         0

For more information on Cflowd flows, see the show sdwan app-fwd cflowd flows command page.

Configure cflowd traffic flow monitoring using the CLI

This task configures Cflowd traffic flow monitoring to enable network visibility and flow monitoring capabilities on managed devices. The configuration includes setting up flow templates, collectors, and applying policies to monitor network traffic patterns.

Cflowd traffic flow monitoring provides visibility into network traffic patterns and flow characteristics. This configuration is performed from the Cisco SD-WAN Controller that controls the Cisco IOS XE Catalyst SD-WAN devices in your network.

Before you begin

Ensure you have CLI access to the Cisco SD-WAN Controller controller.

Follow these steps to configure Cflowd traffic flow monitoring using the CLI:

Procedure

	1.	Configure a Cflowd template to specify flow visibility and flow sampling parameters: Example: `vSmart(config)# policy cflowd-template template-name vSmart(config-cflowd-template)# flow-active-timeout seconds vSmart(config-cflowd-template)# flow-inactive-timeout seconds vSmart(config-cflowd-template)# flow-sampling-interval number vSmart(config-cflowd-template)# template-refresh seconds vSmart(config-cflowd-template)# protocol ipv4\|ipv6\|Both` Note On Cisco IOS XE Catalyst SD-WAN devices, a flow-active-timeout is fixed as 60 seconds. If a flow-inactive-timeout is fixed as 10 seconds. The flow-active-timeout and flow-inactive-timeout value that is configured on Cisco SD-WAN Controller or Cisco SD-WAN Manager do not take effect on Cisco IOS XE Catalyst SD-WAN devices.
	2.	To collect TOS, DSCP output and TLOC loopback in flow monitor: Example: `vSmart(config-cflowd-template)# customized-ipv4-record-fields vsmart(config-customized-ipv4-record-fields)# collect-tos vsmart(config-customized-ipv4-record-fields)# collect-dscp-output vSmart(config-cflowd-template)# collect-tloc-loopback` Starting Cisco Catalyst SD-WAN Manager Release 20.12.1, when you configure a loopback interface as an ingress or egress transport interface, this feature enables you to collect loopback instead of physical interface in FNF records. This feature is supported for IPv4 and IPv6.
	3.	Configure a flow collector: Example: `vSmart(config-cflowd-template)# collector vpn vpn-id address ip-address port port-number transport transport-type source-interface interface-name export-spread enable app-tables app-tables tloc-tables tloc-tables other-tablesother-tables` Note You can configure app-tables, TLOC-tables, and other-tables options only using Cisco SD-WAN Controllers. Note Cisco IOS XE Catalyst SD-WAN devices only support UDP collector. Irrespective of the transport protocol that is configured, UDP is the default collector for Cisco IOS XE Catalyst SD-WAN devices.
	4.	Configure a data policy that defines traffic match parameters and that includes the action cflowd: Example: `vSmart(config)# policy data-policy policy-name vSmart(config-data-policy)# sequence number vSmart(config-sequence)# match match-parameters vSmart(config-sequence)# action cflowd`
	5.	Create lists of sites in the overlay network that contain the Cisco IOS XE Catalyst SD-WAN devices to which you want to apply the traffic flow monitoring policy. To include multiple site in the list, configure multiple vpn vpn-id commands. Example: `vSmart(config)# policy lists vSmart(config-lists)# vpn-list list-name vSmart(config-vpn-list)# vpn vpn-id`
	6.	Apply the data policy to the sites in the overlay network that contain the Cisco IOS XE Catalyst SD-WAN devices: Example: `vSmart(config)# apply-policy site-list list-name vSmart(config-site-list)# data-policy policy-name vSmart(config-site-list)# cflowd-template template-name`

Cflowd traffic flow monitoring is now configured and applied to the specified network sites. The system will collect flow data according to the configured template parameters and send it to the specified collectors for analysis and monitoring.

Configure flexible netflow on VPN0 interface

This task enables Flexible Netflow (FNF) on a VPN0 interface to monitor traffic metrics using the Easy Performance Monitor (ezPM) profile.

The ezPM profile helps in creating a new profile to carry all the Netflow VPN0 monitor configuration. On selecting a profile and specifying a few parameters, ezPM provides the remaining provisioning information. A profile is a pre-defined set of traffic monitors that can be enabled or disabled for a context.

Procedure

Configure the performance monitor context using the sdwan-FNF profile and specify the traffic monitor settings.

Example:

Device# config-transaction
Device(config)# performance monitor context <monitor_name> profile <sdwan-fnf> traffic-monitor <all> [ipv4/ipv6] 
Device(config-perf-mon)# exporter destination <destination address> source <source interface> transport udp vrf <vrf-name> port <port-number> dscp <dscp>

The following example shows how to configure a performance monitor context using the sdwan-FNF profile. This configuration enables monitoring of traffic metrics. Here, 10.1.1.1 is the IP address of the third-party collector, GigabitEthernet5 is the source interface, and 4739 is the listening port of the third-party collector.

Device# config-transaction
Device(config)# performance monitor context <monitor_name> profile sdwan-fnf traffic-monitor all [ipv4/ipv6] 
Device(config-perf-mon)# exporter destination <10.1.1.1> source <GigabitEthernet5> transport udp vrf <vrf1> port <4739> dscp <1>

FNF is successfully configured on the VPN0 interface with the specified performance monitor context and traffic monitoring capabilities.

Configure flexible NetFlow with the export of BFD metrics using the CLI

Configure Flexible NetFlow to export BFD metrics data for network monitoring and analysis purposes.

Minimum releases: Cisco IOS XE Catalyst SD-WAN Release 17.10.1a and Cisco Catalyst SD-WAN Control Components Release 20.10.1

From the CLI on the Cisco SD-WAN Controller that is controlling the Cisco IOS XE Catalyst SD-WAN device, enter the following commands depending on if you want to enable or disable the export of BFD metrics using a data policy.

Procedure

	1.	Enable the export of BFD metrics. Example: `policy cflowd-template template-name collector vpn vpn-id address ip-address port port transport transport source-interface interface bfd-metrics-export export-interval export-interval` The default BFD export interval is 600 seconds. BFD export interval is independent of a Cflowd template refresh. The BFD export interval only controls the interval for sending data from the BFD-metrics-export table. For the tunnel-tloc table, the BFD export interval uses the minimum value between the BFD export interval and the Cflowd template refresh as the interval to send data.
	2.	Disable the export of BFD metrics. Example: `policy cflowd-template template-name collector vpn vpn-id address ip-address port port transport transport source-interface interface no bfd-metrics-export`

BFD metrics export is configured according to your requirements. The system will export BFD metrics data at the specified intervals if enabled, or stop exporting if disabled.

Complete configuration example

Here is a complete configuration example for enabling BFD metrics export.

policy
 cflowd-template fnf
  template-refresh 600
  collector vpn 0 address 10.0.100.1 port 4739 transport transport_udp
   bfd-metrics-export
    export-interval 30
   !
  !
 !
 lists
  site-list 500
   site-id 500
  !
 !
!
apply-policy
 site-list 500
  cflowd-template fnf
 !
!

Configuration examples for flexible NetFlow export of BFD metrics

This reference provides configuration examples for Flexible NetFlow export of Bidirectional Forwarding Detection (BFD) metrics. Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.10.1a and Cisco Catalyst SD-WAN Control Components Release 20.10.1.

This example shows a centralized policy configuration with export of BFD metrics enabled:

Device# show sdwan policy from-vsmart 
from-vsmart cflowd-template fnf
 flow-active-timeout    600
 flow-inactive-timeout  60
 template-refresh       600
 flow-sampling-interval 1
 protocol               ipv4
 customized-ipv4-record-fields
  no collect-tos
  no collect-dscp-output
 collector vpn 0 address 10.0.100.1 port 4739 transport transport_udp
  bfd-metrics-export
   export-interval 600

This example shows FNF BFD telemetry data with average jitter, average latency, and loss metrics:

{ 'Data_Template': 'Data_Flow',
  'ObservationDomainId': 6,
  'Version': 10,
  'arrive_time': 1658807309.2496994,
  'dfs_tfs_length': 200,
  'export_dfs_tfs_templates_list_dict': { 'FlowSequence': 3354,
                                          'Flowset_id': '258',
                                          'Flowset_length': 200,
                                          'Length': 286,
                                          'ObservationDomainId': 6,
                                          'TimeStamp': 1658807269,
                                          'Version': 10,
                                          'flow': [ { 'bfd_avg_jitter': 1000,
                                                      'bfd_avg_latency': 1000,
                                                      'bfd_loss': 15,
                                                      'bfd_pfr_update_ts': 1658806692155,
                                                      'bfd_rx_cnt': 0,
                                                      'bfd_tx_cnt': 0,
                                                      'ipDiffServCodePoint': 48,
                                                      'tloc_table_overlay_session_id': 10},
                                                      …
                                                  ]},
 'flow_length': 4,
  'flow_time': 1658807269,
  'flowset_id': '258',
  'header': { 'FlowSequence': 3354,
              'Length': 286,
              'ObservationDomainId': 6,
              'TimeStamp': 1658807269,
              'Version': 10},
  'host': '10.0.100.15',
  'ipfix_length': 286,
  'packet_number': 2,
  'template_id': '258'}

This example displays cflowd Forwarding Table Manager (FTM) statistics:

Minimum supported release: Cisco IOS XE Release 17.4.1a

device# show sdwan app-fwd cflowd statistics ftm
      ftm-flow-rate-limit      :      0
      ipfix-data-flow-rate     :      0
      ipfix-data-packet-rate   :      0
      flow-rate-limit-drop     :      0
      app-aggregation-db-cnt   :      0
      app-aggregation-aged-cnt :      0
      app-aggregation-drop-cnt :      0
      app-aggregation-high-watermark :0
====================================================================
      ftm-fw-zone-pair         :      0
      ftm-fw-zone              :      0
      ftm-utd-policy           :      0
      ftm-utd-policy-aged      :      0
      ftm-utd-urlf-url         :      0
      ftm-utd-urlf-url-aged    :      0
      ftm-utd-amp-filename     :      0
      ftm-utd-amp-filename-aged:      0
      ftm-utd-amp-malname      :      0
      ftm-utd-amp-malname-aged :      0
      ftm-c3pl-class           :      0
      ftm-c3pl-policy          :      0

This example displays cflowd Data Tracking Agent (DTA) statistics:

Minimum supported release: Cisco IOS XE Catalyst SD-WAN Release 17.18.1a

device# show sdwan app-fwd cflowd statistics dta
DTA Common Statistics Summary

dta_flow_rate_limit: 27000
dta_punt_packet_rate_limit: 1928
dta_flow_seq_drop: 0
dta_fnf_cb_cnt: 5405
dta_lowq_active_cnt: 0
ipfix_data_flow_rate: 0
ipfix_data_packet_rate: 0

Apply and enable cflowd policy

Apply and activate Cflowd policy to enable traffic flow monitoring and data collection on sites in the overlay network.

A centralized data policy must be applied to a list of sites and activated before it takes effect. The Cflowd template must be associated with the data policy for traffic flow monitoring capabilities.

Before you begin

Follow these steps to apply and enable Cflowd policy:

Procedure

	1.	Apply the centralized data policy to a site list. Example: `vSmart(config)# apply-policy site-list list-name data-policy policy-name`
	2.	Associate the Cflowd template with the data policy to activate it. Example: `vSmart(config)# apply-policy cflowd-template template-name` For all data-policy policies that you apply with apply-policy commands, the site IDs across all the site lists must be unique. That is, the site lists must not contain overlapping site IDs. An example of overlapping site IDs are those in the two site lists site-list 1 site-id 1-100 and site-list 2 site-id 70-130. Here, sites 70 through 100 are in both lists. If you apply these two site lists to two different data-policy policies, the attempt to commit the configuration on the Cisco Catalyst SD-WAN Controller would fail. The same type of restriction also applies to the following types of policies: Application-aware routing policy (app-route-policy) Centralized control policy (control-policy) Centralized data policy (data-policy) You can, however, have overlapping site IDs for site lists that you apply for different types of policy. For example, the sites lists for control-policy and data-policy policies can have overlapping site IDs. So for the two example site lists above, site-list 1 site-id 1-100 and site-list 2 site-id 70-130, you could apply one to a control policy and the other to a data policy.
	3.	Commit the configuration to activate it. After you successfully activate the configuration by issuing a commit command, the Cisco Catalyst SD-WAN Controller pushes the data policy to the Cisco IOS XE Catalyst SD-WAN devices located in the specified sites. To view the policy as configured on the Cisco Catalyst SD-WAN Controller, use the show running-config command in the Cisco Catalyst SD-WAN Controller. To view the policy that has been pushed to the device, use the show policy from-vsmart command on the device.
	4.	Display the centralized data policy configuration on the Cisco Catalyst SD-WAN Controller. Example: `vSmart# show running-config policy vSmart# show running-config apply-policy`
	5.	Display the centralized data policy that has been pushed to the Cisco IOS XE Catalyst SD-WAN device. Example: `Device# show sdwan policy from-vsmart`
	6.	Enable Cflowd visibility directly on Cisco IOS XE Catalyst SD-WAN devices for traffic flow monitoring on all VPNs. Example: `Device(config)# policy flow-visibility` You can enable Cflowd visibility directly on Cisco IOS XE Catalyst SD-WAN devices, without configuring a data policy, so that you can perform traffic-flow monitoring on traffic coming to the router from all VPNs in the LAN. Note Do not attach the flow monitor to a certain interface after configuring the flow or app visibility. The policy flow-visibility command applies the global flow monitor. You need not attach the monitor to any interface again manually.
	7.	Monitor the applications using the show commands on the device. To monitor the applications, use the show app cflowd flows and show app cflowd statistics commands on the device.

The Cflowd policy is successfully applied and activated, enabling traffic flow monitoring across the specified sites. The policy configuration is pushed to the devices and flow visibility is enabled for monitoring applications.

Configure cflowd traffic flow monitoring

This task enables you to configure Cflowd traffic flow monitoring with a centralized data policy to monitor network traffic and send flow information to collectors for analysis.

Cflowd traffic monitoring is configured on a Cisco Catalyst SD-WAN Controller controller using centralized data policy. This approach allows you to monitor specific traffic types and send flow data to collectors for network analysis and troubleshooting.

Before you begin

Follow these steps to configure Cflowd traffic flow monitoring:

Procedure

	1.	Create a Cflowd template to define the location of the collector and to modify Cflowd timers. Example: `vsmart(config)# policy cflowd-template test-cflowd-template vsmart(config-cflowd-template-test-cflowd-template)# collector vpn 1 address 172.16.155.15 port 13322 transport transport_udp vsmart(config-cflowd-template-test-cflowd-template)# flow-inactive-timeout 60 vsmart(config-cflowd-template-test-cflowd-template)# template-refresh 90`
	2.	Create a list of VPNs whose traffic you want to monitor. Example: `vsmart(config)# policy lists vpn-list vpn_1 vpn 1`
	3.	Create a list of sites to apply the data policy to. Example: `vsmart(config)# policy lists site-list cflowd-sites site-id 400,500,600`
	4.	Configure the data policy. Example: `vsmart(config)# policy data-policy test-cflowd-policy vsmart(config-data-policy-test-cflowd-policy)# vpn-list vpn_1 vsmart(config-vpn-list-vpn_1)# sequence 1 vsmart(config-sequence-1)# match protocol 6 vsmart(config-match)# exit vsmart(config-sequence-1)# action accept cflowd vsmart(config-action)# exit vsmart(config-sequence-1)# exit vsmart(config-vpn-list-vpn_1)# default-action accept`
	5.	Apply the policy and the Cflowd template to sites in the overlay network. Example: `vsmart(config)# apply-policy site-list cflowd-sites data-policy test-cflowd-policy Device(config-site-list-cflowd-sites)# cflowd-template test-cflowd-template`
	6.	Activate the data policy. Example: `vsmart(config-site-list-cflowd-sites)# validate Validation complete vsmart(config-site-list-cflowd-sites)# commit Commit complete. vsmart(config-site-list-cflowd-sites)# exit configuration-mode`

Cflowd traffic monitoring is configured and active. The system monitors TCP traffic from the specified VPNs and sites, sending flow data to the configured collector. You can verify the configuration and check flow statistics using the appropriate show commands.

Here is a complete example of a Cflowd configuration:

vsmart(config)# show configuration
apply-policy
 site-list cflowd-sites
  data-policy     test-cflowd-policy
  cflowd-template test-cflowd-template
 !
!
policy
 data-policy test-cflowd-policy
  vpn-list vpn_1
   sequence 1
    match
     protocol 6
    !
    action accept
     cflowd
    !
   !
   default-action accept
  !
 !
 cflowd-template test-cflowd-template
  flow-inactive-timeout 60
  template-refresh      90
  collector vpn 1 address 192.168.0.1 protocol ipv4 port 13322 transport transport_udp
 !
 lists
  vpn-list vpn_1
   vpn 1
  !
  site-list cflowd-sites
   site-id 400,500,600
  !
 !
!

The following sample output from the show sdwan run policy command displays the configuration for IPv4 and IPv6 application visibility and flow visibility for Cflowd with SAIE flows:

Device# show sdwan run policy
policy
 app-visibility
 app-visibility-ipv6
 flow-visibility
 flow-visibility-ipv6

To verify the Cflowd configuration after activating it on the Cisco Catalyst SD-WAN Controller, use the show running-config policy and show running-config apply-policy commands.

The following is a sample output from the show sdwan policy from-vsmart cflowd-template command:

Device# show sdwan policy from-vsmart cflowd-template 
from-vsmart cflowd-template test-cflowd-template
 flow-active-timeout   30
 flow-inactive-timeout 60
 template-refresh      90
 flow-sampling-interval 1
 protocol ipv4/ipv6/both 
 customized-ipv4-record-fields
  collect-tos
  collect-dscp-output

collector vpn 1 address 192.0.2.1 protocol ipv4 port 13322 transport transport_udp

The following is a sample output from the show sdwan policy from-vsmart command:

Device# show sdwan policy from-vsmart 
from-vsmart data-policy test-cflowd-policy
 vpn-list vpn_1
  sequence 1
   match
    protocol 6
   action accept
    cflowd
  default-action accept
from-vsmart cflowd-template test-cflowd-template
 flow-active-timeout   30
 flow-inactive-timeout 60
 protocol ipv4/ipv6/both
 template-refresh      90  
 customized-ipv4-record-fields
   collect-tos
   collect-dscp-output
 collector vpn 1 address 192.0.2.1 port 13322 transport transport_udp
from-vsmart lists vpn-list vpn_1
 vpn 1

Starting from Cisco IOS XE Catalyst SD-WAN Release 17.12.1a, the cflowd commands have been enhanced for both IPv4 and IPv6 flow records.

The following is the sample output from the show flow record command where it has been enhanced by the addition of a new field collect connection initiator which specifies the direction of flow.

Device# show flow record sdwan_flow_record-xxx 

IPv4 flow record:

flow record sdwan_flow_record-1666223692122679:
  Description:        flow and application visibility records
  No. of users:       1
  Total field space:  102 bytes
  Fields:
    match ipv4 protocol
    match ipv4 source address
    match ipv4 destination address
    match transport source-port
    match transport destination-port
    match routing vrf service
    collect ipv4 dscp
    collect transport tcp flags
    collect interface input
    collect interface output
    collect counter bytes long
    collect counter packets long
    collect timestamp absolute first
    collect timestamp absolute last
    collect application name
    collect flow end-reason
    collect connection initiator
    collect overlay session id input
    collect overlay session id output
    collect connection id long
    collect drop cause id
    collect counter bytes sdwan dropped long
    collect sdwan sla-not-met
    collect sdwan preferred-color-not-met
    collect sdwan qos-queue-id
collect counter packets sdwan dropped long

IPv6 flow format:

flow record sdwan_flow_record_ipv6-1667963213662363:
  Description:        flow and application visibility records
  No. of users:       1
  Total field space:  125 bytes
  Fields:
    match ipv6 protocol
    match ipv6 source address
    match ipv6 destination address
    match transport source-port
    match transport destination-port
    match routing vrf service
    collect ipv6 dscp
    collect transport tcp flags
    collect interface input
    collect interface output
    collect counter bytes long
    collect counter packets long
    collect timestamp absolute first
    collect timestamp absolute last
    collect application name
    collect flow end-reason
    collect connection initiator
    collect overlay session id input
    collect overlay session id output
    collect connection id long
    collect drop cause id
    collect counter bytes sdwan dropped long
    collect sdwan sla-not-met
    collect sdwan preferred-color-not-met
    collect sdwan qos-queue-id
    collect counter packets sdwan dropped long

The following is the enhanced sample output from the show flow monitor monitor-namecache command where a new field connection initiator indicating flow direction has been added in the output. The connection initiator field can have one of these values - initiator for client to server traffic flow, reverse for server to client and unknown when the direction of traffic flow is not known.

Device# show flow monitor sdwan_flow_monitor cache
Cache type: Normal (Platform cache)
Cache size: 128000
Current entries: 4
High Watermark: 5
Flows added: 6
Flows aged: 2
- Inactive timeout ( 10 secs) 2
IPV4 SOURCE ADDRESS: 10.20.24.110
IPV4 DESTINATION ADDRESS: 10.20.25.110
TRNS SOURCE PORT: 40254
TRNS DESTINATION PORT: 443
IP VPN ID: 1
IP PROTOCOL: 6
tcp flags: 0x02
interface input: Gi5
interface output: Gi1
counter bytes long: 3966871
counter packets long: 52886
timestamp abs first: 02:07:45.739
timestamp abs last: 02:08:01.840
flow end reason: Not determined
connection initiator: Initiator
interface overlay session id input: 0
interface overlay session id output: 4
connection connection id long: 0xD8F051F000203A22

On the Cisco IOS XE Catalyst SD-WAN devices affected by the Cflowd data policy, various commands let you check the status of the Cflowd flows.

Device# show sdwan app-fwd cflowd statistics 

      data_packets             :      0 
      template_packets         :      0 
      total-packets            :      0 
      flow-refresh             :      123 
      flow-ageout              :      117 
      flow-end-detected        :      0 
      flow-end-forced          :      0

The following example shows the centralized policy configuration with Cflowd for IPv6 traffic:

policy
 data-policy _vpn_1_accept_cflowd_vpn_1
  vpn-list vpn_1
   sequence 102
    match
     source-ipv6      2001:DB8:0:/32
     destination-ipv6 2001:DB8:1:/32
    !
    action accept
     count  cflowd_ipv6_1187157291
     cflowd
    !
   !
   default-action accept
  !
 !
 cflowd-template cflowd_server
  flow-active-timeout   60
  flow-inactive-timeout 30
  protocol              ipv6   
 !
 lists
  vpn-list vpn_1
   vpn 1
  site-list vedge1
   site-id 500
  !

apply-policy
 site-list vedge1
  data-policy _vpn_1_accept_cflowd_vpn_1 all
  cflowd-template cflowd_server

The following example shows the configuration for export spreading:

Device# show sdwan policy from-vsmart
from-vsmart cflowd-template cflowd
 flow-active-timeout    600
 flow-inactive-timeout  60
 template-refresh       60
 flow-sampling-interval 1
 protocol               ipv4
 customized-ipv4-record-fields
  no collect-tos
  no collect-dscp-output
 collector vpn 0 address 10.0.100.1 port 4739 transport transport_udp
  export-spread
   app-tables   20
   tloc-tables  10
   other-tables 5

Configure the maximum FNF record rate for aggregated data using the CLI

This task configures the maximum FNF record rate to control the volume of aggregated traffic data that a device sends per minute.

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.14.1a, Cisco Catalyst SD-WAN Control Components Release 20.14.1

For more information about using CLI templates, see CLI Add-On Feature Templates and CLI Templates. By default, CLI templates execute commands in global configuration mode.

Procedure

Configure the maximum rate (FNF records per minute) for a device to send aggregated traffic data to Cisco SD-WAN Manager.

Example:

policy app-agg-node max-records-per-minute

The device is configured with the specified maximum FNF record rate for sending aggregated traffic data.

Set maximum FNF records to 1000 per minute

The following configures a device to send a maximum of 1000 FNF records per minute of aggregated traffic data.

policy app-agg-node 1000

Restore default maximum FNF records

The following restores a device to the default value of sending a maximum of 10000 FNF records per minute of aggregated traffic data.

no policy app-agg-node