Configure the NetFlow ON ASR1000series

Updating....

2019-11-11 version1

 

Creating a Flow Record

Perform this task to configure a customized flow record.

Customized flow records are used to analyze traffic data for a specific purpose. A customized flow record must have at least one match criterion for use as the key field and typically has at least one collect criterion for use as a nonkey field.

There are hundreds of possible permutations of customized flow records. This task shows the steps that are used to create one of the possible permutations. Modify the steps in this task as appropriate to create a customized flow record for your requirements.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    flow record record-name

4.    description description

5.    match {ip | ipv6} {destination | source} address

6.    Repeat Step 5 as required to configure additional key fields for the record.

7.   

8.    Repeat the above step as required to configure additional nonkey fields for the record.

9.    end

10.    show flow record record-name

11.    show running-config flow record record-name

 

Configuring a Flow Monitor for IPv4 or IPv6 Traffic Using the Predefined Record

To configure a flow monitor for IPv4/IPv6 traffic using the Flexible NetFlow "NetFlow IPv4/IPv6 original input" predefined record for the flow monitor, perform the following required task.

Each flow monitor has a separate cache assigned to it. Each flow monitor requires a record to define the contents and layout of its cache entries. The record format can be one of the predefined record formats, or an advanced user may create his or her own record format using the collect and matchcommands in Flexible NetFlow flow record configuration mode.

Note	You must remove a flow monitor from all of the interfaces to which you have applied it before you can modify the record format of the flow monitor.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    flow monitor monitor-name

4.    description description

5.    record netflow {ipv4 | ipv6} original-input

6.    end

7.    show flow monitor [[name] monitor-name [cache [format {csv | record | table}]][statistics]]

8.    show running-config flow monitor monitor-name

 

Configuring a Flow Exporter for the Flow Monitor

 

Perform this optional task to configure a flow exporter for the flow monitor in order to export the data that is collected by Flexible NetFlow to a remote system for further analysis and storage.

Flow exporters are used to send the data that you collect with Flexible NetFlow to a remote system such as a NetFlow Collection Engine. Exporters use UDP as the transport protocol and use the Version 9 export format.

Note	Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor. You can export to a destination using either an IPv4 or IPv6 address.

Note	When you configure an exporter, configure the exporter in such a way that the source interface is defined as a WAN interface. This configuration helps you prevent any unpredictable behavior because the NAT is not applied on the packets.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    flow exporter exporter-name

4.    description description

5.    destination {hostname | ip-address} [vrf vrf-name]

6.    export-protocol {netflow-v5 | netflow-v9 | ipfix}

7.    transport udp udp-port

8.    exit

9.    flow monitor flow-monitor-name

10.    exporter exporter-name

11.    end

12.    show flow exporter exporter-name

13.    show running-config flow exporter exporter-nam

 

Creating a Flow Monitor

Perform this required task to create a customized flow monitor.

Each flow monitor has a separate cache assigned to it. Each flow monitor requires a record to define the contents and layout of its cache entries. These record formats can be a user-defined format. An advanced user can create a customized format using the flow record command.

Before You Begin

If you want to use a customized record, you must create the customized record before you can perform this task. If you want to add a flow exporter to the flow monitor for data export, you must create the exporter before you can complete this task.

Note	You must use the no ip flow monitor command to remove a flow monitor from all of the interfaces to which you have applied it before you can modify the parameters for the record command on the flow monitor.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    flow monitor monitor-name

4.    description description

5.    record {record-name}

6.    cache {timeout {active} seconds | { normal }

7.    Repeat Step 6 as required to finish modifying the cache parameters for this flow monitor.

8.    exporter exporter-name

9.    end

10.    show flow monitor [[name] monitor-name [cache [format {csv | record | table}]] ]

11.    show running-config flow monitor monitor-nam

 

Applying a Flow Monitor to an Interface

Before it can be activated, a flow monitor must be applied to at least one interface. Perform this required task to activate a flow monitor.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    {ip | ipv6} flow monitor monitor-name {input | output}

5.    Repeat Steps 3 and 4 to activate a flow monitor on any other interfaces in the device over which you want to monitor traffic.

6.    end

7.    show flow interface type number

8.    show flow monitor name monitor-name cache format record