Feature history of NetFlow

Feature history of NetFlow
Feature name Releases Feature information
NetFlow and Traffic Analysis Cisco IOS XE 26.2.1 Release NetFlow is a protocol and Cisco technology for exporting metrics and statistics about IP traffic flows. A flow exporter sends flow data from the router to a flow collector. The collector receives, aggregates, and presents the flow data for analysis. From this release, Cisco 8000 Series Secure Routers can be configured for NetFlow feature using Cisco Meraki Dashboard.

NetFlow

NetFlow provides traffic visibility by collecting flow data on a Cisco IOS XE secure router and exporting that data to an external collector for analysis and operational troubleshooting.

Flexible NetFlow allows traffic analysis parameters to be customized by using reusable components such as flow records, flow monitors, flow exporters, and flow samplers. Flow monitors are applied to interfaces to collect flow data. Flow exporters export flow monitor cache data to a remote system, such as a NetFlow collector.

Traffic Analysis provides Dashboard traffic visibility from the router flow data. TA1 reports client-level usage, while TA2 adds richer flow-level usage details.

NetFlow and Traffic Analysis use the same unified Flexible NetFlow flow record and flow monitor. When NetFlow and Traffic Analysis are enabled at the same time, only one unified monitor is configured. Traffic Analysis uses either the ta1-exporter or ta2-exporter, while NetFlow adds the customer-netflow exporter to the same flow monitor.

  • TA1 uses ta1-exporter and sends client-level data to the local controller.
  • TA2 uses ta2-exporter and sends application and flow-level data to the local controller.
  • NetFlow uses customer-netflow and sends external flow exports to the configured customer collector.

Prerequisites for NetFlow

  • A NetFlow collector is required.
  • The collector address and UDP port must be configured.
  • The Cisco IOS-XE secure router network must be eligible for NetFlow support.
  • For Flexible NetFlow, the networking device must run a Cisco release that supports Flexible NetFlow.
  • For IPv4 traffic, IPv4 routing must be configured and Cisco Express Forwarding or distributed Cisco Express Forwarding must be enabled on the device and on interfaces where Flexible NetFlow is enabled.
  • NetFlow uses IPFIX format by default.

Configure NetFlow

Choose one of the methods to configure NetFlow:

Configure NetFlow in Cisco Meraki Dashboard

Configure NetFlow in Dashboard.

For information about NetFlow on Cisco Meraki Dashboard, refer to NetFlow Overview.

Step 1

From the Cisco Meraki Dashboard, choose Network-wide > Configure > General.

Step 2

Click Reporting.

  1. Enable NetFlow traffic reporting.

  2. Configure the NetFlow collector IP address.

  3. Configure the NetFlow collector UDP port.

Step 3

Click Save.

NetFlow configuration on Cisco Secure Routers

 Note

The router configurations are not manually set on the router. The configurations are generated from Dashboard intent and pushed automatically.

The generated configuration uses the shared dashboard flow record.

Dashboard flow record

flow record dashboard
match application name
match flow observation point
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match ipv4 version
match routing vrf service
match transport destination-port
match transport source-port
collect connection initiator
collect connection new-connections
collect counter bytes long
collect counter packets long
collect flow cts source group-tag
collect flow flags
collect interface input
collect interface output
collect timestamp absolute first
collect timestamp absolute last
collect transport tcp flags

Customer flow exporter

Configure the flow exporters before attaching them to the flow monitor.

flow exporter customer-netflow
destination 1.2.3.4 [vrf CLOUD_DEFAULT_VRF]
export-protocol ipfix
template data timeout 300
option application-table timeout 300
option application-attributes timeout 300
option interface-table timeout 300
option vrf-table timeout 300

Traffic Analysis flow exporters

flow exporter ta1-exporter
destination local controller
export-protocol ipfix
template data timeout 300
option application-table timeout 300
option application-attributes timeout 300
option vrf-table timeout 300
flow exporter ta2-exporter
destination local controller
export-protocol ipfix
template data timeout 300
option application-table timeout 300
option application-attributes timeout 300
option interface-table timeout 300
option vrf-table timeout 300

Shared dashboard flow monitor

The generated configuration uses the shared dashboard flow monitor.

The shared monitor contains either ta1-exporter or ta2-exporter, but not both. When NetFlow is enabled, customer-netflow is attached to the same monitor.

flow monitor dashboard
exporter ta2-exporter
exporter customer-netflow
cache timeout inactive 10
cache timeout active 60
record dashboard

Flow monitor interfaces

Apply Flow Monitor to an interface.

interface TenGigabitEthernet0/0/8
ip flow monitor dashboard input wan
!
interface TenGigabitEthernet0/0/9
ip flow monitor dashboard input wan
!
interface Virtual-Template1 type tunnel
ip flow monitor dashboard input wan
!
interface Vlan15
ip flow monitor dashboard input lan
!
interface GigabitEthernet0/0/5
ip flow monitor dashboard input lan

Verify NetFlow configurations

Verify the customer-netflow exporter

Verify that the show flow exporter customer-netflow command includes the configured collector IP, collector port, VRF label `0`, export protocol IPFIX, and the expected option timeouts. 


Device#show flow exporter customer-netflow
Flow Exporter customer-netflow:
Description:              User defined
Export protocol:          IPFIX (Version 10)
Transport Configuration:
Destination type:       IP
Destination IP address: 1.2.3.4
VRF label:              0
Source IP address:      0.0.0.0
Transport Protocol:     UDP
Destination Port:       4739
Source Port:            0
DSCP:                   0x0
TTL:                    255
Output Features:        Used
  Export template data timeout:        300
Options Configuration:
interface-table (timeout 300 seconds)  (active)
vrf-table (timeout 300 seconds)  (active)
application-table (timeout 300 seconds)  (active)
application-attributes (timeout 300 seconds)  (active)

Verify the dashboard flow monitor

Verify that the show flow monitor dashboard command lists the shared flow record `dashboard`, the active Traffic Analysis exporter (`ta1-exporter` or `ta2-exporter`), and `customer-netflow` when NetFlow is enabled.


Device#show flow monitor dashboard
Flow Monitor dashboard:
Description:       User defined
  Flow Record:       dashboard
Flow Exporter:     ta1-exporter
   Flow Exporter:     customer-netflow
Cache:
Type:                 normal (Platform cache)
Status:               allocated
Size:                 200000 entries
Inactive Timeout:     10 secs
Active Timeout:       60 secs
Trans end aging:   off