Configuring NetFlow Export on an IOS Device

     

    Follow the steps below to configure NetFlow export on a Cisco IOS device.

    Tip
    Refer the Cisco Version Matrix for information on Cisco platforms and IOS versions supporting NetFlow

     

    Enabling NetFlow Export

    Enter global configuration mode on the router or MSFC, and issue the following commands for each interface on which you want to enable NetFlow:

    interface {interface} {interface_number}

    ip flow ingress

    bandwidth

    exit

     

    Tip
    In some recent IOS releases Cisco Express Forwarding has to be enabled. Issue the command ip cef in global configuration mode on the router or MSFC for this.

    This enables NetFlow on the specified interface alone. Remember that on a Cisco IOS device, NetFlow is enabled on a per-interface basis. The bandwidth command is optional, and is used to set the speed of the interface in kilobits per second. Interface speed or link speed value is used to later calculate percentage utilization values in traffic graphs.

    Exporting NetFlow Data

    Issue the following commands to export NetFlow data to the server on which NetFlow Analyzer is running:

     

    Command Purpose
    ip flow-export destination{hostname|ip_address}9996 Exports the NetFlow cache entries to the specified IP address. Use the IP address of the NetFlow Analyzer server and the configured NetFlow listener port. The default port is 9996.
    ip flow-export source {interface}{interface_number} Sets the source IP address of the NetFlow exports sent by the device to the specified IP address. NetFlow Analyzer will make SNMP requests of the device on this address.
    ip flow-export version 5 [peer-as | origin-as] Sets the NetFlow export version to version 5. NetFlow Analyzer supports only version 5, version 7 and version 9. If your router uses BGP you can specify that either the origin or peer AS is included in exports - it is not possible to include both.
    ip flow-cache timeout active 1

    Breaks up long-lived flows into 1-minute fragments. You can choose any number of minutes between 1 and 60. If you leave it at the default of 30 minutes your traffic reports will have spikes.

    It is important to set this value to 1 minute in order to troubleshooting data.
    ip flow-cache timeout inactive 15 Ensures that flows that have finished are periodically exported. The default value is 15 seconds. You can choose any number of seconds between 10 and 600. However, if you choose a value greater than 250 seconds, NetFlow Analyzer may report traffic levels that are too low.
    snmp-server ifindex persist Enables ifIndex persistence (interface names) globally. This ensures that the ifIndex values are persisted during device reboots.

     

    Tip
    For more information on BGP reporting in NetFlow Analyzer, look up the section on Configuring NetFlow for BGP

     

    Verifying Device Configuration

    Issue the following commands in normal (not configuration) mode to verify whether NetFlow export has been configured correctly:

     

    Command Purpose
    show ip flow export Shows the current NetFlow configuration
    show ip cache flow These commands summarize the active flows and indicate how much NetFlow data the device is exporting
    show ip cache verbose flow

    A Sample Device Configuration

    The following is a set of commands issued on a router to enable NetFlow version 5 on the FastEthernet 0/1 interface and export to the machine 192.168.9.101 on port 9996.

     

    router#enable

    Password:*****

    router#configure terminal

    router-2621(config)#interface FastEthernet 0/1

    router-2621(config-if)#ip flow ingress

    router-2621(config-if)#exit

    router-2621(config)#ip flow-export destination 192.168.9.101 9996

    router-2621(config)#ip flow-export source FastEthernet 0/1

    router-2621(config)#ip flow-export version 5

    router-2621(config)#ip flow-cache timeout active 1

    router-2621(config)#ip flow-cache timeout inactive 15

    router-2621(config)#snmp-server ifindex persist

    router-2621(config)#^Z

    router#write

    router#show ip flow export

    router#show ip cache flow

    *repeat these commands to enable NetFlow for each interface

     

    impo

    Please note that NetFlow data export has to be enabled on all interfaces of a router in order to see accurate IN and OUT traffic. Suppose you have a router with interface A and B. Since NetFlow, by default, is done on an ingress basis, when you enable NetFlow data export on interface A, it will only export the IN traffic for interface A and OUT traffic for interface B. The OUT traffic for interface A will be contributed by the NetFlow data exported from interface B.

    Even if you are interested in managing only interface A, please enable NetFlow data export on A and B. You may subsequently unmanage interface B from the License Management link.

     

     

     

    Turning off NetFlow

    Issue the following commands in global configuration mode to stop exporting NetFlow data:

     

    Command Purpose
    no ip flow-export destination{port_number} This will stop exporting NetFlow cache entries to the specified destination IP address on the specified port number
    interface {interface_number} This will disable NetFlow export on the specified interface. Repeat the commands for each interface on which you need to disable NetFlow.
    no ip flow ingress or no ip flow egress
    exit

     

    Tip

    For further information on configuring your IOS device for NetFlow data export, refer Cisco's NetFlow commands documentation