Configure and verify Cisco NetFlow

Exam: Cisco 200-301 - Cisco Certified Network Associate (CCNA)

Netflow allows you to collect, monitor and analyze network traffic. It was initially developed as a switching technology by Cisco but later evolved into a full-fledged network traffic collection and analysis standard. Netflow allows you to monitor an interface of a net flow enabled device, collect traffic statistics that pass through it, and store it in cache.

The data collected in cache is then exported to a flow analyzer tool to analyze bandwidth usage patterns of applications, troubleshooting traffic bottlenecks, and then finding out the best way to use the available bandwidth.

Neflow is simple to use because it does not require any connection setup protocols on devices that use it. It need not be enabled on all the devices. You can simply enable it on the interface of a device that you want to monitor.

Netflow version 5

Netflow version 5 is the most commonly used version of Netflow that allows the use of Autonomous System reporting. It is the traditional version of Netflow and has a fixed packet format or data structure that does not allow any additional information to be added to by Cisco or any other vendor. This feature also makes it easily understandable and usable.

If you try to change Netflow v5 you will get obscure flow formats that will not work with v5 collector. The v5 allows all flows to be calculated when they come to the inbound interface. It is therefore advised to enable netflow version 5 on all the interfaces to allow monitoring of both inbound and outbound traffic on those interfaces.

The code sample given below enables NetFlow version 5 on the FastEthernet 0/1 interface data and then export the data to the NetFlow Analyzer server having IP address 10.192.11.103 on port 2055, which is a UDP port to export NetFlow packets.

RouterR1#enable

RouterR1#configure terminal

RouterR1#enable Password:*****

Specify interface and enter interface configuration mode

RouterR1 (config)#interface FastEthernet 0/1

Enable netflow for ip routing

RouterR1 (config-if)#ip route-cache flow

Exit interface configuration mode

RouterR1 (config-if)#exit

Provide the IP address of the NetFlow Collector server and the port number used to send NetFlow packets.

RouterR1(config)#ip flow-export destination 10.192.11.103 2055

Specify the interface that would be used to export NetFlow packets

RouterR1 (config)#ip flow-export source GigabitEthernet0/1

Specify the netflow version used

RouterR1 (config)#ip flow-export version 5

Break up long-lived flows into 5-minute fragments

RouterR1 (config)#ip flow-cache timeout active 5

Configure that finished flows are periodically exported after 15 seconds

RouterR1 (config)#ip flow-cache timeout inactive 15

Ensure that the ifIndex values persist during router reboots

RouterR1 (config)#snmp-server ifindex persist

RouterR1 (config)#^Z

Netflow ver 9

The netflow version 9 is the most recent version of netflow flow-record format. It is template based and provides a flexible flow export. It allows you to monitor a wide range of IP packets information that includes new fields and record types, which is not available in version 5 of netflow. It also allows use of custom fields such as Multicast IP traffic, VLAN ID, IPv6 traffic, and MPLS labels.

Netflow version 9 or flexible netflow is comprised of three components. These three components are:

Flow record: The flow record provides a description of a template, which is sent periodically to netflow collector so that the collector can interpret datagrams and describe network sessions. The record specifies which data goes to which field, the length of the field, and how to interpret these fields.

A flow record is created using two main commands, Match and Collect.

The match command denotes a mandatory field or a key field. If the match fails, the record is not filled. For example, if the match field is IPv4 address, and the match need to be made to the IPv6 address that does not contain an IPv4 address, the match fails and no record is generated.

The collect command denotes an optional non key value such as VLAN. A space is reserved for collect fields but if they do not exist then a ‘0’ is put on their place.

Flow exporter: The flow exporter provides the description of the destination of the flow record, which is a collector. It contains the network and transport layer information for the export packet and has nothing to do with data being sent, it only concerns about building envelop for the data. It determines how often the templates need to be sent and what will be the delay. You can configure export destination IP address, source interface, UDP port number, and export format while configuring exporters.

Flow monitor: This is the final stage and in this stage you need to setup a monitor. For each different type of record a separate monitor is created. For example, both IPv4 and IPv6 create different records so a separate monitor for each IPv4 and IPv6 is created. You need to attach an interface to the monitor.

Configure netflow version 9

RouterR1#enable

RouterR1#configure terminal

RouterR1#enable Password:*****

Creating a flow record

Create a name to define the netflow record

RouterR1(config)# flow record ipv4record

Enter into netflow configuration mode and define match commands

RouterR1(config-flow-record)# match ipv4 source address

RouterR1(config-flow-record)# match ipv4 destination address

RouterR1(config-flow-record)# match ipv4 protocol

RouterR1(config-flow-record)# match transport source-port

RouterR1(config-flow-record)# match transport destination-port

RouterR1(config-flow-record)# match interface input

Define collect commands

RouterR1(config-flow-record)# collect interface output

RouterR1(config-flow-record)# collect counter bytes

RouterR1(config-flow-record)# collect counter packets

Creating Flow Exporter

Create a netflow exporter

RouterR1(config)# flow exporter my-netflow-exporter

Specify the IP address of the NetFlow Collector server

RouterR1 (config-flow-exporter)#destination 10.192.10.103

Specify the source or the return address that will be used to identify this device tothe collector

RouterR1 (config-flow-exporter)# source GigabitEthernet0/1

Define the port number and the protocol used to send packets. The default netflow port is 2055 /UDP

RouterR1 (config-flow-exporter)# transport udp 2055 NetFlow packets are exported.

Send a template every 1 minute

RouterR1 (config-flow-exporter)# template data timeout 60

Creating a Flow Monitor

RouterR1 (config)# flow monitor mainmonitor

RouterR1 (config-flow-monitor)# record ipv4record

RouterR1 (config-flow-monitor)# exporter ipv4export

RouterR1 (config-flow-monitor)# cache timeout active 60

RouterR1 (config-flow-monitor)# cache timeout inactive 15

Associate the Monitor to an Interface

RouterR1 (config)# int FastEthernet0/1

RouterR1 (config-if)# ip flow monitor mainmonitor input

Save configuration

RouterR1#write

Verify Netflow Configuration

Use following commands to verify netflow configurations:

show flow exporter [name]: Use this command to display information about NetFlow flow exporters and statistics.
show flow interface [interface-type number] : Use this command to display information about NetFlow interfaces.
show flow monitor [name] [cache [detailed]] : Use this command to display information about NetFlow flow monitors and statistics.
show flow record [name] : Use this command to display information about NetFlow flow records.

Example Question

The Flow exporter component of Netflow ver 9 is contains which of the following type of information?

Flow exporter component contains the keys that NetFlow uses to identify packets
Flow exporter component contains the network layer and transport layer details for the NetFlow export packet
Flow exporter component contains the monitor references.
None of the above

Correct Answer: 2

The flow exporter component contains the network layer and transport layer details for the NetFlow export packet

Related IT Guides