Manufacturer: Cisco

Switch Model(s): Catalyst 9000 family

Wireless Controller Model(s): Catalyst 9800 Series

Access Point Model(s): Catalyst 9100 Series

Router Model(s): ASR 900/1000 Series, NCS 4200 Series, Catalyst 8000 Edge Platforms, ISR 1000/4000 Series, IR1100/IR1800/IR8100/IR8300 Series, Catalyst 8000V Edge, CSR1000v, CBR Series

Version(s): IOS XE 17

URL: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/xe-17/fnf-xe-17-book/fnf-v5-export.html

Notes:

  • Some Cisco devices support additional licensing to provide NBAR, TrustSEC, and ETA analytics. Refer to the appropriate Cisco Data sheet to determine if your device supports these features.

Configuration steps for layer 3 Flexible NetFlow

  1. Create a Flow Record
configure terminal
flow record FLOW-RECORD
description flow record
  match ipv4 tos
  match ipv4 protocol
  match ipv4 source address
  match ipv4 destination address
  match transport source-port
  match transport destination-port
  match interface input
  match flow direction
  collect routing source as
  collect routing destination as
  collect routing next-hop address ipv4
  collect ipv4 dscp
  collect ipv4 id
  collect ipv4 source prefix
  collect ipv4 source mask
  collect ipv4 destination mask
  collect ipv4 ttl minimum
  collect ipv4 ttl maximum
  collect transport tcp flags
  collect interface output
  collect counter bytes
  collect counter packets
  collect timestamp sys-uptime first
  collect timestamp sys-uptime last
  exit

CLI command

Description

 
Flow record <name>

Creates a flow record and enters flow record configuration mode.

 
Description <string>

Describes this flow record as a maximum 63-character string.

 
Match <type>

Specifies match keys. Plixer recommended keys are listed in the example above

 
Collect <type>

Specifies the collection field. Plixer recommended fields are listed in the example above.
  1. Create a flow Exporter
configure terminal
flow exporter PLIXER-COLLECTOR
  description Plixer Platform Flow Collector
  destination <IP of Plixer collector>
  source <interface>
  export-protocol ipfix
  transport udp 9995
  exit

CLI command

Description

 
flow exporter <name>

Creates a flow exporter and enters flow exporter configuration mode

 
description <string>

Describes this flow exporter as a maximum 63-character string

 
destination <ip> [use vrf-name]

IPv4 address of the Plixer collector. You can optionally configure the VRF to use to reach the NetFlow Collector.

 
source <interface>

Source interface for sending Flow. Must be reachable via SNMP by Plixer.

 
export-protocol ipfix

Specifies that ipfix be used by the exporter.

 
transport udp <port>

Specifies the UDP port to use to reach the NetFlow Collector. The range is from 0 to 65535.
  1. Create a Flow Monitor
configure terminal
flow monitor FLOW-COLLECTION
  description flow collection
  record FLOW-RECORD
  exporter PLIXER-COLLECTOR
  cache timeout 60
  exit

CLI command

Description

 
flow monitor <name>

Creates a flow monitor and enters flow monitor configuration mode

 
description <string>

Describes this flow monitor as a maximum 63-character string

 
record <name>

Associates a flow record with this flow monitor.

 
exporter <name>

Associates a flow exporter with this flow monitor.

 
cache timeout <seconds>

Sets the flow timeout length. Plixer recommends this be set to 60 seconds.
  1. Apply a Flow Monitor to an interface
configure terminal
interface <interface>
  ip flow monitor FLOW-COLLECTION input
  exit

CLI command

Description

 
Ip flow monitor <ipv4 |ipv6> input

Associates an IPv4 or IPv6 flow monitor to the interface for input packets.

 

  1. Configure ETA

Must have the appropriate licensing to enable these features.

 

configure terminal
et-analytics
  ip flow-export destination <IP of Plixer collector> 2055
  inactive-timeout 15

interface <interface>
  et-analytics enable
  exit
  1. Add Trustsec SGT information into Flow Records

Must have the appropriate licensing to enable these features.

 

configure terminal
flow record FLOW-RECORD
  match flow cts source group-tag
  match flow cts destination group-tag
  exit


  1. Add NBAR data to the flow record

Must have the appropriate licensing to enable these features.

configure terminal
flow record FLOW-RECORD
  collect application name
  collect application http url
  collect application http host
  collect connection delay response to-server sum
  collect connection delay response to-server min
  collect connection delay response to-server max
  collect connection delay network to-server sum
  collect connection delay network to-client sum
  collect connection delay network client-to-server sum
  collect connection delay application sum
  collect connection delay application min
  collect connection delay application max
  collect connection delay response client-to-server sum
  exit