Configure and verify Cisco NetFlow
Exam: 300-101 - Implementing Cisco IP Routing (ROUTE v2.0)
Netflow allows you to collect, monitor and analyze network traffic. It was initially developed as a switching technology by Cisco but later evolved into a full-fledged network traffic collection and analysis standard. Netflow allows you to monitor an interface of a net flow enabled device, collect traffic statistics that pass through it, and store it in cache.
The data collected in cache is then exported to a flow analyzer tool to analyze bandwidth usage patterns of applications, troubleshooting traffic bottlenecks, and then finding out the best way to use the available bandwidth.
Neflow is simple to use because it does not require any connection setup protocols on devices that use it. It need not be enabled on all the devices. You can simply enable it on the interface of a device that you want to monitor.
Netflow version 5
Netflow version 5 is the most commonly used version of Netflow that allows the use of Autonomous System reporting. It is the traditional version of Netflow and has a fixed packet format or data structure that does not allow any additional information to be added to by Cisco or any other vendor. This feature also makes it easily understandable and usable.
If you try to change Netflow v5 you will get obscure flow formats that will not work with v5 collector. The v5 allows all flows to be calculated when they come to the inbound interface. It is therefore advised to enable netflow version 5 on all the interfaces to allow monitoring of both inbound and outbound traffic on those interfaces.
The code sample given below enables NetFlow version 5 on the FastEthernet 0/1 interface data and then export the data to the NetFlow Analyzer server having IP address 10.192.11.103 on port 2055, which is a UDP port to export NetFlow packets.
Specify interface and enter interface configuration mode
RouterR1 (config)#interface FastEthernet 0/1
Enable netflow for ip routing
RouterR1 (config-if)#ip route-cache flow
Exit interface configuration mode
Provide the IP address of the NetFlow Collector server and the port number used to send NetFlow packets.
RouterR1(config)#ip flow-export destination 10.192.11.103 2055
Specify the interface that would be used to export NetFlow packets
RouterR1 (config)#ip flow-export source GigabitEthernet0/1
Specify the netflow version used
RouterR1 (config)#ip flow-export version 5
Break up long-lived flows into 5-minute fragments
RouterR1 (config)#ip flow-cache timeout active 5
Configure that finished flows are periodically exported after 15 seconds
RouterR1 (config)#ip flow-cache timeout inactive 15
Ensure that the ifIndex values persist during router reboots
RouterR1 (config)#snmp-server ifindex persist
Netflow ver 9
The netflow version 9 is the most recent version of netflow flow-record format. It is template based and provides a flexible flow export. It allows you to monitor a wide range of IP packets information that includes new fields and record types, which is not available in version 5 of netflow. It also allows use of custom fields such as Multicast IP traffic, VLAN ID, IPv6 traffic, and MPLS labels.
Netflow version 9 or flexible netflow is comprised of three components. These three components are:
Flow record: The flow record provides a description of a template, which is sent periodically to netflow collector so that the collector can interpret datagrams and describe network sessions. The record specifies which data goes to which field, the length of the field, and how to interpret these fields.
A flow record is created using two main commands, Match and Collect.
The match command denotes a mandatory field or a key field. If the match fails, the record is not filled. For example, if the match field is IPv4 address, and the match need to be made to the IPv6 address that does not contain an IPv4 address, the match fails and no record is generated.
The collect command denotes an optional non key value such as VLAN. A space is reserved for collect fields but if they do not exist then a ‘0’ is put on their place.
Flow exporter: The flow exporter provides the description of the destination of the flow record, which is a collector. It contains the network and transport layer information for the export packet and has nothing to do with data being sent, it only concerns about building envelop for the data. It determines how often the templates need to be sent and what will be the delay. You can configure export destination IP address, source interface, UDP port number, and export format while configuring exporters.
Flow monitor: This is the final stage and in this stage you need to setup a monitor. For each different type of record a separate monitor is created. For example, both IPv4 and IPv6 create different records so a separate monitor for each IPv4 and IPv6 is created. You need to attach an interface to the monitor.
Configure netflow version 9
Creating a flow record
Create a name to define the netflow record
RouterR1(config)# flow record ipv4record
Enter into netflow configuration mode and define match commands
RouterR1(config-flow-record)# match ipv4 source address
RouterR1(config-flow-record)# match ipv4 destination address
RouterR1(config-flow-record)# match ipv4 protocol
RouterR1(config-flow-record)# match transport source-port
RouterR1(config-flow-record)# match transport destination-port
RouterR1(config-flow-record)# match interface input
Define collect commands
RouterR1(config-flow-record)# collect interface output
RouterR1(config-flow-record)# collect counter bytes
RouterR1(config-flow-record)# collect counter packets
Creating Flow Exporter
Create a netflow exporter
RouterR1(config)# flow exporter my-netflow-exporter
Specify the IP address of the NetFlow Collector server
RouterR1 (config-flow-exporter)#destination 10.192.10.103
Specify the source or the return address that will be used to identify this device tothe collector
RouterR1 (config-flow-exporter)# source GigabitEthernet0/1
Define the port number and the protocol used to send packets. The default netflow port is 2055 /UDP
RouterR1 (config-flow-exporter)# transport udp 2055 NetFlow packets are exported.
Send a template every 1 minute
RouterR1 (config-flow-exporter)# template data timeout 60
Creating a Flow Monitor
RouterR1 (config)# flow monitor mainmonitor
RouterR1 (config-flow-monitor)# record ipv4record
RouterR1 (config-flow-monitor)# exporter ipv4export
RouterR1 (config-flow-monitor)# cache timeout active 60
RouterR1 (config-flow-monitor)# cache timeout inactive 15
Associate the Monitor to an Interface
RouterR1 (config)# int FastEthernet0/1
RouterR1 (config-if)# ip flow monitor mainmonitor input
Verify Netflow Configuration
Use following commands to verify netflow configurations:
- show flow exporter [name]: Use this command to display information about NetFlow flow exporters and statistics.
- show flow interface [interface-type number] : Use this command to display information about NetFlow interfaces.
- show flow monitor [name] [cache [detailed]] : Use this command to display information about NetFlow flow monitors and statistics.
- show flow record [name] : Use this command to display information about NetFlow flow records.
The Flow exporter component of Netflow ver 9 is contains which of the following type of information?
- Flow exporter component contains the keys that NetFlow uses to identify packets
- Flow exporter component contains the network layer and transport layer details for the NetFlow export packet
- Flow exporter component contains the monitor references.
- None of the above
Correct Answer: 2
The flow exporter component contains the network layer and transport layer details for the NetFlow export packet
Related IT Guides
- Configure and Verify IP SLA
- Configure and verify IPv4 Network Address Translation (NAT)
- Configure And Verify Manual and Autosummarization With Any Routing Protocol
- Configure and Verify Network Time Protocol (NTP)
- Configure and verify PPP
- Configure and verify static routing
- Configure And Verify VRF Lite
- Describe IP operations
- Recognize proposed changes to the network
- Troubleshoot passive interfaces