Follow the steps below to configure NetFlow export on a Cisco IOS device.
Refer the Cisco Version Matrix for information on Cisco platforms and IOS versions supporting NetFlow
|
Enter global configuration mode on the router or MSFC, and issue the following commands for each interface on which you want to enable NetFlow:
interface {interface} {interface_number}
ip flow ingress
bandwidth
exit
In some recent IOS releases Cisco Express Forwarding has to be enabled. Issue the command
ip cef in global configuration mode on the router or MSFC for this. |
This enables NetFlow on the specified interface alone. Remember that on a Cisco IOS device, NetFlow is enabled on a per-interface basis. The bandwidth
command is optional, and is used to set the speed of the interface in kilobits per second. Interface speed or link speed value is used to later calculate percentage utilization values in traffic graphs.
Issue the following commands to export NetFlow data to the server on which NetFlow Analyzer is running:
Command | Purpose |
ip flow-export destination{hostname|ip_address}9996 |
Exports the NetFlow cache entries to the specified IP address. Use the IP address of the NetFlow Analyzer server and the configured NetFlow listener port. The default port is 9996. |
ip flow-export source {interface}{interface_number} |
Sets the source IP address of the NetFlow exports sent by the device to the specified IP address. NetFlow Analyzer will make SNMP requests of the device on this address. |
ip flow-export version 5 [peer-as | origin-as] |
Sets the NetFlow export version to version 5. NetFlow Analyzer supports only version 5, version 7 and version 9. If your router uses BGP you can specify that either the origin or peer AS is included in exports - it is not possible to include both. |
ip flow-cache timeout active 1 |
Breaks up long-lived flows into 1-minute fragments. You can choose any number of minutes between 1 and 60. If you leave it at the default of 30 minutes your traffic reports will have spikes. It is important to set this value to 1 minute in order to troubleshooting data. |
ip flow-cache timeout inactive 15 |
Ensures that flows that have finished are periodically exported. The default value is 15 seconds. You can choose any number of seconds between 10 and 600. However, if you choose a value greater than 250 seconds, NetFlow Analyzer may report traffic levels that are too low. |
snmp-server ifindex persist |
Enables ifIndex persistence (interface names) globally. This ensures that the ifIndex values are persisted during device reboots. |
For more information on BGP reporting in NetFlow Analyzer, look up the section on Configuring NetFlow for BGP
|
Issue the following commands in normal (not configuration) mode to verify whether NetFlow export has been configured correctly:
Command | Purpose |
show ip flow export |
Shows the current NetFlow configuration |
show ip cache flow |
These commands summarize the active flows and indicate how much NetFlow data the device is exporting |
show ip cache verbose flow |
The following is a set of commands issued on a router to enable NetFlow version 5 on the FastEthernet 0/1 interface and export to the machine 192.168.9.101 on port 9996.
|
*repeat these commands to enable NetFlow for each interface
Please note that NetFlow data export has to be enabled on all interfaces of a router in order to see accurate IN and OUT traffic. Suppose you have a router with interface A and B. Since NetFlow, by default, is done on an ingress basis, when you enable NetFlow data export on interface A, it will only export the IN traffic for interface A and OUT traffic for interface B. The OUT traffic for interface A will be contributed by the NetFlow data exported from interface B.
|
Issue the following commands in global configuration mode to stop exporting NetFlow data:
Command | Purpose |
no ip flow-export destination{port_number} |
This will stop exporting NetFlow cache entries to the specified destination IP address on the specified port number |
interface {interface_number} |
This will disable NetFlow export on the specified interface. Repeat the commands for each interface on which you need to disable NetFlow. |
no ip flow ingress or no ip flow egress |
|
exit |
For further information on configuring your IOS device for NetFlow data export, refer Cisco's NetFlow commands documentation |