Describes how to verify that traffic flow monitoring is functioning correctly and provides information about the verification process and related procedures.
The following sections provide information about verifying traffic flow monitoring.
Verify collect loopback
You can verify the ingress and egress interface output using these commands.
show sdwan app-fwd cflowd flows
This is a sample output from the show sdwan app-fwd cflowd flows using the flows keyword.
Device#show sdwan app-fwd cflowd flows
app-fwd cflowd flows vpn 1 src-ip 10.10.15.12 dest-ip 10.20.15.12 src-port 0 dest-port 0 dscp 0 ip-proto 1
tcp-cntrl-bits 24
icmp-opcode 0
total-pkts 5
total-bytes 500
start-time "Tue Jun 27 09:21:09 2023"
egress-intf-name Loopback1
ingress-intf-name GigabitEthernet5
application ping
family network-service
drop-cause "No Drop"
drop-octets 0
drop-packets 0
sla-not-met 0
color-not-met 0
queue-id 2
initiator 2
tos 0
dscp-output 0
sampler-id 0
fec-d-pkts 0
fec-r-pkts 0
pkt-dup-d-pkts-orig 0
pkt-dup-d-pkts-dup 0
pkt-dup-r-pkts 0
pkt-cxp-d-pkts 0
category 0
service-area 0
cxp-path-type 0
region-id 0
ssl-read-bytes 0
ssl-written-bytes 0
ssl-en-read-bytes 0
ssl-en-written-bytes 0
ssl-de-read-bytes 0
ssl-de-written-bytes 0
ssl-service-type 0
ssl-traffic-type 0
ssl-policy-action 0
appqoe-action 0
appqoe-sn-ip 0.0.0.0
appqoe-pass-reason 0
appqoe-dre-input-bytes 0
appqoe-dre-input-packets 0
appqoe-flags 0You can verify the ingress and egress interface output using this command.
show sdwan app-fwd cflowd table
This is a sample output from the show sdwan app-fwd cflowd table using the table keyword.
show sdwan app-fwd cflowd flows table
PKT PKT PKT PKT SSL SSL APPQOE APPQOE
TCP SLA COLOR FEC FEC DUP D DUP D DUP CXP CXP SSL SSL EN SSL EN DE SSL DE SSL SSL SSL APPQOE DRE DRE
SRC DEST IP CNTRL ICMP TOTAL TOTAL EGRESS INTF INGRESS INTF DROP DROP NOT NOT QUEUE DSCP SAMPLER D R PKTS PKTS R D SERVICE PATH REGION READ WRITTEN READ WRITTEN READ WRITTEN SERVICE TRAFFIC POLICY APPQOE APPQOE PASS INPUT INPUT APPQOE
VPN SRC IP DEST IP PORT PORT DSCP PROTO BITS OPCODE PKTS BYTES START TIME NAME NAME APPLICATION FAMILY DROP CAUSE OCTETS PACKETS MET MET ID INITIATOR TOS OUTPUT ID PKTS PKTS ORIG DUP PKTS PKTS CATEGORY AREA TYPE ID BYTES BYTES BYTES BYTES BYTES BYTES TYPE TYPE ACTION ACTION SN IP REASON BYTES PACKETS FLAGS
----------------
1 10.10.15.11 10.20.20.10 0 0 0 1 24 0 5 500 Tue Jun 27 09:21:06 2023 Loopback1 GigabitEthernet5 ping network-service No Drop 0 0 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0
0 10.0.5.5 10.0.15.10 58048 22 4 6 24 0 41 1752 Tue Jun 27 09:21:06 2023 internal0/0/rp:0 GigabitEthernet9 unknown network-service No Drop 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0
1 10.10.15.11 10.20.20.10 0 2048 0 1 24 2048 5 500 Tue Jun 27 09:21:06 2023 GigabitEthernet5 Loopback1 ping network-service No Drop 0 0 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0
1 10.10.15.11 10.5.10.15 0 2048 0 1 31 2048 20 960 Tue Jun 27 09:21:06 2023 Null GigabitEthernet5 ping network-service Ipv4NoRoute 960 20 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0
1 10.10.15.11 10.20.20.10 50920 4739 0 17 31 0 473 524768 Tue Jun 27 09:21:06 2023 GigabitEthernet5 internal0/0/rp:0 ipfix network-management No Drop 0 0 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0
0 10.0.5.10 10.0.5.10 22 58048 48 6 24 0 39 3020 Tue Jun 27 09:21:05 2023 GigabitEthernet9 internal0/0/rp:0 ssh terminal No Drop 0 0 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0
1 10.10.15.11 10.20.20.10 0 771 48 1 31 771 8 4192 Tue Jun 27 09:21:05 2023 internal0/0/rp:0 GigabitEthernet5 icmp network-service No Drop 0 0 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0
1 fe40::6044:ff:feb7:c2db ff01::1:ff00:10 0 34560 0 58 0 34560 6 432 Tue Jun 27 09:20:41 2023 internal0/0/rp:0 GigabitEthernet5 ipv6-icmp network-service No Drop 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0
1 10:20:20::10 fe40::6024:ff:feb6:c1db 0 34816 56 58 0 34816 4 288 Tue Jun 27 09:20:41 2023 GigabitEthernet5 internal0/0/rp:0 ipv6-icmp network-service No Drop 0 0 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.0.0.0 0 0 0 0 Verify interface binding on the device
You can verify the interface binding on the device using this command.
show sdwan control local-properties WAN-interface-list
This is a sample output from the show sdwan control local-properties WAN-interface-list using the WAN-interface-list keyword.
The command displays:
-
The physical interface bound to the loopback WAN interface in bind mode.
-
Unbind for loopback WAN interface in unbind mode.
-
N/A for any other cases.
Device#show sdwan control local-properties wan-interface-list
NAT TYPE: E -- indicates End-point independent mapping
A -- indicates Address-port dependent mapping
N -- indicates Not learned
Note: Requires minimum two vbonds to learn the NAT type
PUBLIC PUBLIC PRIVATE PRIVATE PRIVATE
MAX RESTRICT/ LAST SPI TIME NAT VM BIND
INTERFACE IPv4 PORT IPv4 IPv6 PORT VS/VM COLOR STATE
CNTRL CONTROL/ LR/LB CONNECTION REMAINING TYPE CON REG INTERFACE
STUN PRF IDs
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
GigabitEthernet1 10.0.10.10 12346 10.0.10.10 :: 12346 2/1 lte up 2 no/yes/no No/No 0:20:20:27 0:01:14:20 N 5 Default N/A
GigabitEthernet4 10.0.10.10 12346 10.0.10.10 :: 12346 2/0 blue up 2 no/yes/no No/No 0:20:20:27 0:01:14:20 N 5 Default N/A
Loopback1 1.1.1.1 12366 1.1.1.1 :: 12366 2/0 custom1 up 2 no/yes/no No/No 0:20:20:27 0:01:14:20 N 5 Default GigabitEthernet1
Loopback2 2.2.2.2 12406 2.2.2.2 :: 12406 2/0 custom2 up 2 no/yes/no No/No 0:20:20:27 0:01:14:20 N 5 Default UnbindVerify the flexible NetFlow configuration on the VPN0 interface
This reference provides verification commands for Flexible NetFlow (FNF) configuration on the VPN0 interface, including commands to view flow records, monitor configuration, cache details, and exporter settings.
View flexible netflow record configuration summary
You can verify FNF record configuration using this command.
Device# show flow record <monitor-context-name>The monitor name is used as temp0 in these examples.
This sample output displays the information about IPv4 traffic flow records using ezPM profile.
Device# show flow record temp0-sdwan-fnf-vpn0-monitor_ipv4
flow record temp0-sdwan-fnf-vpn0-monitor_ipv4:
Description: ezPM record
No. of users: 1
Total field space: 66 bytes
Fields:
match ipv4 dscp
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match flow direction
collect routing next-hop address ipv4
collect transport tcp flags
collect interface input
collect interface output
collect flow sampler
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last
collect application name
collect flow end-reason
This sample output displays the information about IPv6 traffic flow records using ezPM profile.
Device# show flow record temp0-sdwan-fnf-vpn0-monitor_ipv6
flow record temp0-sdwan-fnf-vpn0-monitor_ipv6:
Description: ezPM record
No. of users: 1
Total field space: 102 bytes
Fields:
match ipv6 dscp
match ipv6 protocol
match ipv6 source address
match ipv6 destination address
match transport source-port
match transport destination-port
match flow direction
collect routing next-hop address ipv6
collect transport tcp flags
collect interface input
collect interface output
collect flow sampler
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last
collect application name
collect flow end-reason
This sample output displays the monitor information about IPv4 traffic netflow configuration using ezPM profile.
Device# show flow monitor temp0-sdwan-fnf-vpn0-monitor_ipv4
Flow Monitor temp0-sdwan-fnf-vpn0-monitor_ipv4:
Description: ezPM monitor
Flow Record: temp0-sdwan-fnf-vpn0-monitor_ipv4
Cache:
Type: normal (Platform cache)
Status: allocated
Size: 5000 entries
Inactive Timeout: 10 secs
Active Timeout: 60 secs
Trans end aging: off
This sample output displays the monitor information about IPv6 traffic netflow configuration using ezPM profile.
Device# show flow monitor temp0-sdwan-fnf-vpn0-monitor_ipv6
Flow Monitor temp0-sdwan-fnf-vpn0-monitor_ipv6:
Description: ezPM monitor
Flow Record: temp0-sdwan-fnf-vpn0-monitor_ipv6
Cache:
Type: normal (Platform cache)
Status: allocated
Size: 5000 entries
Inactive Timeout: 10 secs
Active Timeout: 60 secs
Trans end aging: off
View flow record cache
This sample output displays flow record cache for the specified monitor, in this case, temp0-sdwan-FNF-vpn0-monitor_ipv4.
Device# show flow monitor temp0-sdwan-fnf-vpn0-monitor_ipv4 cache
Cache type: Normal (Platform cache)
Cache size: 5000
Current entries: 14
High Watermark: 14
Flows added: 170
Flows aged: 156
- Active timeout ( 60 secs) 156
IPV4 SOURCE ADDRESS: 10.0.0.0
IPV4 DESTINATION ADDRESS: 10.255.255.254
TRNS SOURCE PORT: 0
TRNS DESTINATION PORT: 0
FLOW DIRECTION: Input
IP DSCP: 0x00
IP PROTOCOL: 1
ipv4 next hop address: 10.0.0.1
tcp flags: 0x00
interface input: Gi1
interface output: Gi2
flow sampler id: 0
counter bytes long: 840
counter packets long: 10
timestamp abs first: 02:55:24.359
timestamp abs last: 02:55:33.446
flow end reason: Not determined
application name: layer7 ping
……
This sample output displays flow record cache for the specified IPv6 monitor, temp0-sdwan-FNF-vpn0-monitor_ipv6.
Device# show flow monitor temp0-sdwan-fnf-vpn0-monitor_ipv6 cache
Cache type: Normal (Platform cache)
Cache size: 5000
Current entries: 6
High Watermark: 6
Flows added: 10
Flows aged: 4
- Inactive timeout ( 10 secs) 4
IPV6 SOURCE ADDRESS: 2001:DB8::/32
IPV6 DESTINATION ADDRESS: 2001:DB8::1
TRNS SOURCE PORT: 0
TRNS DESTINATION PORT: 32768
FLOW DIRECTION: Output
IP DSCP: 0x00
IP PROTOCOL: 58
ipv6 next hop address: 2001:DB8:1::1
tcp flags: 0x00
interface input: Gi2
interface output: Gi1
flow sampler id: 0
counter bytes long: 2912
counter packets long: 28
timestamp abs first: 02:57:06.025
timestamp abs last: 02:57:33.378
flow end reason: Not determined
application name: prot ipv6-icmp
This sample output displays the flow exporter details.
Device# show flow exporter temp0
Flow Exporter temp0:
Description: performance monitor context temp0 exporter
Export protocol: IPFIX (Version 10)
Transport Configuration:
Destination type: IP
Destination IP address: 10.0.0.1
VRF label: 1
Source IP address: 10.0.0.0
Source Interface: GigabitEthernet5
Transport Protocol: UDP
Destination Port: 4739
Source Port: 51242
DSCP: 0x1
TTL: 255
Output Features: Used
Export template data timeout: 300
Options Configuration:
interface-table (timeout 300 seconds) (active)
vrf-table (timeout 300 seconds) (active)
sampler-table (timeout 300 seconds) (active)
application-table (timeout 300 seconds) (active)
application-attributes (timeout 300 seconds) (active)
Verify the flexible NetFlow configuration with the export of BFD metrics
Minimum releases: Cisco IOS XE Catalyst SD-WAN Release 17.10.1a and Cisco Catalyst SD-WAN Control Components Release 20.10.1
Flow exporter configuration verification
The sample output from the show flow exporter command displays the configuration of each flow exporter:
Device# show flow exporter
…
Flow Exporter sdwan_flow_exporter_1:
Description: export flow records to collector
Export protocol: IPFIX (Version 10)
Transport Configuration:
Destination type: IP
Destination IP address: 10.0.100.1
Source IP address: 10.0.100.15
Transport Protocol: UDP
Destination Port: 4739
Source Port: 54177
DSCP: 0x0
TTL: 255
MTU: 1280
Output Features: Used
Options Configuration:
interface-table (timeout 600 seconds) (active)
tunnel-tloc-table (timeout 600 seconds) (active)
bfd-metrics-table (timeout 600 seconds) (active)Flow exporter statistics verification
The sample output from the show flow exporter statistics command displays the client-sent statistics of each flow exporter:
Device# show flow exporter statistics
…
Flow Exporter sdwan_flow_exporter_1:
Packet send statistics (last cleared 3d05h ago):
Successfully sent: 1433 (907666 bytes)
Client send statistics:
Client: Option options interface-table
Records added: 6552
- sent: 6552
Bytes added: 694512
- sent: 694512
Client: Option options tunnel-tloc-table
Records added: 1916
- sent: 1916
Bytes added: 99632
- sent: 99632
Client: Flow Monitor sdwan_flow_monitor
Records added: 0
Bytes added: 0
Client: Option options bfd-metrics-table
Records added: 4
- sent: 4
Bytes added: 196
- sent: 196Flow exporter templates verification
The sample output from the show flow exporter templates command displays the details for each template:
Device# show flow exporter templates
…
Client: Option options tunnel-tloc-table
Exporter Format: IPFIX (Version 10)
Template ID : 257
Source ID : 6
Record Size : 52
Template layout
_____________________________________________________________________________
| Field | ID | Ent.ID | Offset | Size |
-----------------------------------------------------------------------------
| TLOC TABLE OVERLAY SESSION ID | 12435 | 9 | 0 | 4 |
| tloc local color | 12437 | 9 | 4 | 16 |
| tloc remote color | 12439 | 9 | 20 | 16 |
| tloc tunnel protocol | 12440 | 9 | 36 | 8 |
| tloc local system ip address | 12436 | 9 | 44 | 4 |
| tloc remote system ip address | 12438 | 9 | 48 | 4 |
-----------------------------------------------------------------------------
Client: Option options bfd-metrics-table
Exporter Format: IPFIX (Version 10)
Template ID : 262
Source ID : 6
Record Size : 49
Template layout
_____________________________________________________________________________
| Field | ID | Ent.ID | Offset | Size |
-----------------------------------------------------------------------------
| TLOC TABLE OVERLAY SESSION ID | 12435 | 9 | 0 | 4 |
| IP DSCP | 195 | | 4 | 1 |
| bfd loss | 12527 | 9 | 5 | 4 |
| bfd pfr update ts | 12530 | 9 | 9 | 8 |
| bfd avg latency | 12528 | 9 | 17 | 8 |
| bfd avg jitter | 12529 | 9 | 25 | 8 |
| bfd rx cnt | 12531 | 9 | 33 | 8 |
| bfd tx cnt | 12532 | 9 | 41 | 8 |
-----------------------------------------------------------------------------