-
Cisco IOS Switching Services Configuration Guide, Release 12.2
-
About the Cisco IOS Software Documentation
-
Using Cisco IOS Software
-
Cisco IOS Switching Services Overview
- Part 1: Cisco IOS Switching Paths
- Part 2: NetFlow
- Part 3: Multiprotocol Label Switching
- Part 4: Multilayer Switching
- Part 5: Multicast Distributed Switching
- Part 6: Virtual LANs
- Part 7: LAN Emulation
-
Feedback
Table Of Contents
NetFlow Configuration Task List
Customizing the Number of Entries in the NetFlow Cache
Configuring IP Distributed and NetFlow on VIP Interfaces
Configuring an Aggregation Cache
Verifying Aggregation Cache Configuration and Data Export
Configuring a NetFlow Minimum Prefix Mask for Router-Based Aggregation
Configuring the Minimum Mask of a Prefix Aggregation Scheme
Configuring the Minimum Mask of a Destination-Prefix Aggregation Scheme
Configuring the Minimum Mask of a Source-Prefix Aggregation Scheme
Monitoring and Maintaining Minimum Masks for Aggregation Schemes
Configuring NetFlow Policy Routing
Monitoring NetFlow Policy Routing
NetFlow Configuration Examples
NetFlow Aggregation Configuration Examples
Autonomous System Configuration Example
Destination Prefix Configuration Example
Protocol Port Configuration Example
Source Prefix Configuration Example
Setting a NetFlow Minimum Prefix Mask for Router-Based Aggregation Examples
Prefix Aggregation Scheme Example
Destination-Prefix Aggregation Scheme Example
Source-Prefix Aggregation Scheme Example
NetFlow Policy Routing Example
Configuring NetFlow
This chapter describes how to configure NetFlow data accounting on your routing devices.
For a complete description of the commands in this chapter, refer to the the Cisco IOS Switching Services Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.
To identify the hardware platform or software image information associated with a feature, use the Feature Navigator on Cisco.com to search for information about the feature or refer to the software release notes for a specific release. For more information, see the section "Finding Support Information for Platforms and Cisco IOS Software Images" in the chapter "Using Cisco IOS Software."
What is NetFlow?
NetFlow enables you to collect traffic flow statistics on your routing devices. NetFlow is based on identifying packet flows for ingress IP packets. It does not involve any connection-setup protocol either between routers or to any other networking device or end station and does not require any change externally—either to the traffic or packets themselves or to any other networking device. NetFlow is completely transparent to the existing network, including end stations and application software and network devices like LAN switches. Also, NetFlow is performed independently on each internetworking device, it need not be operational on each router in the network. Using NetFlow Data Export (NDE), you can export data to a remote workstation for data collection and further processing. Network planners can selectively invoke NDE on a router or on a per-subinterface basis to gain traffic performance, control, or accounting benefits in specific network locations.
Note
NetFlow does consume additional memory and CPU resources; therefore, it is important to understand the resources required on your router before enabling NetFlow.
NetFlow Configuration Task List
To configure NetFlow, perform the tasks described in the following sections. The task in the first section is required; the remaining tasks are optional.
•
•
•
•
•
•
•
•
Enabling NetFlow
To enable NetFlow, first configure the router for IP routing as described in the IP configuration chapters in the Cisco IOS IP Configuration Guide, Volume 2 of 3: Routing Protocols. After you configure IP routing, use the following commands beginning in global configuration mode:
Exporting NetFlow Statistics
NetFlow information can also be exported to network management applications. To configure the router to export NetFlow statistics maintained in the NetFlow cache to a workstation when a flow expires, use either of the following commands in global configuration mode:
Customizing the Number of Entries in the NetFlow Cache
Normally the size of the NetFlow cache will meet your needs. However, you can increase or decrease the number of entries maintained in the cache to meet the needs of your NetFlow traffic rates. The default is 64K flow cache entries. Each cache entry requires about 64 bytes of storage. Assuming a cache with the default number of entries, about 4 MB of DRAM would be required. Each time a new flow is taken from the free flow queue, the number of free flows is checked. If only a few free flows remain, NetFlow attempts to age 30 flows using an accelerated timeout. If only one free flow remains, NetFlow automatically ages 30 flows regardless of their age. The intent is to ensure that free flow entries are always available.
To customize the number of entries in the NetFlow cache, use the following command in global configuration mode:
Router(config)# ip flow-cache entries number
Changes the number of entries maintained in the NetFlow cache. The number of entries can be from 1024 to 524288. The default is 65536.
Caution
Managing NetFlow Statistics
You can display and clear NetFlow statistics. NetFlow statistics consist of IP packet size distribution, IP flow cache information, and flow information such as the protocol, total flow, flows per second, and so on. The resulting information can be used to determine information about your router traffic. To manage NetFlow statistics, use the following commands in privileged EXEC mode as needed:
Router# show ip cache flow
Displays the NetFlow statistics.
Router# clear ip flow stats
Clears the NetFlow statistics.
Configuring IP Distributed and NetFlow on VIP Interfaces
On Cisco 7500 series routers with a Route Switch Processor (RSP) and with Versatile Interface Processor (VIP) controllers, the VIP hardware can be configured to switch packets received by the VIP with no per-packet intervention on the part of the RSP. This process is called distributed switching. Distributed switching decreases the demand on the RSP.
The VIP hardware can also be configured for NetFlow, a high-performance feature that caches information about the flow. NetFlow data can also be exported to network management applications.
Refer to the Cisco Product Catalog for information about VIP port adapters used for distributed switching.
To configure distributed switching on the VIP, first configure the router for IP routing as described in this chapter and the various routing protocol chapters, depending on the protocols you use. After you configure IP routing, use the following commands beginning in global configuration mode:
To export NetFlow cache entries to a workstation when a flow expires, use the following command in global configuration mode:
Router(config)# ip flow-export ip-address udp-port
Configures the router to export NetFlow cache entries to a workstation.
Configuring an Aggregation Cache
To configure an aggregation cache, you must enter aggregation cache configuration mode, and you must decide which type of aggregation scheme you would like to configure: Autonomous System, Destination Prefix, Prefix, Protocol Prefix, or Source Prefix aggregation cache. Once you define the aggregation scheme, define the operational parameters for that scheme:
Verifying Aggregation Cache Configuration and Data Export
To verify the aggregation cache information, use the following command in EXEC mode:
To confirm data export, use the following command in EXEC mode:
Router# show ip flow export
Displays the statistics for the data export including the main cache and all other enabled caches.
Configuring a NetFlow Minimum Prefix Mask for Router-Based Aggregation
To configure NetFlow Minimum Prefix Mask for Router-Based Aggregation feature, perform the tasks described in the following sections. Each task is optional.
•
•
•
Per form the following section to verify your NetFlow aggregation configuration:
•
Configuring the Minimum Mask of a Prefix Aggregation Scheme
To configure the minimum mask of a prefix aggregation scheme, use the following commands beginning in aggregation cache configuration mode:
Configuring the Minimum Mask of a Destination-Prefix Aggregation Scheme
To configure the minimum mask of a destination-prefix aggregation scheme, use the following commands beginning in aggregation cache configuration mode:
Configuring the Minimum Mask of a Source-Prefix Aggregation Scheme
To configure the minimum mask of a source-prefix aggregation scheme, use the following commands beginning in aggregation cache configuration mode:
Monitoring and Maintaining Minimum Masks for Aggregation Schemes
To view the configured value of the minimum mask, use the following commands for each aggregation scheme in EXEC mode, as needed:
Note
Configuring NetFlow Policy Routing
As long as policy routing is configured, NetFlow policy routing (NPR) is enabled by default and cannot be disabled. That is, NPR is the default policy routing mode. No configuration tasks are required to enable policy routing in conjunction with CEF or dCEF. As soon as one of these features is turned on, packets are automatically subject to policy routing in the appropriate switching path.
There is one optional configuration command (set ip next-hop verify-availability route-map configuration command). This command has the following restrictions:
•
•
•
•
It is assumed that policy routing itself is already configured.
If the router is policy routing packets to the next hop and the next hop happens to be down, the router will try unsuccessfully to use Address Resolution Protocol (ARP) for the next hop (which is down). This behavior will continue forever.
To prevent this situation, you can configure the router to first verify that the next hops of the route map are CDP neighbors of the router before routing to that next hop.
This task is optional because some media or encapsulations do not support CDP, or it may not be a Cisco device that is sending the router traffic.
To configure the router to verify that the next hop is a CDP neighbor before the router tries to policy route to it, use the following command in route-map configuration mode:
Router(config-route-map)# set ip next-hop verify-availability
Causes the router to confirm that the next hops of the route map are CDP neighbors of the router.
If the command shown is set and the next hop is not a CDP neighbor, the router looks to the subsequent next hop, if there is one. If there is none, the packets simply are not policy routed.
If the command shown is not set, the packets are either successfully policy routed or remain forever unrouted.
If you want to selectively verify availability of only some next hops, you can configure different route-map entries (under the same route-map name) with different criteria (using access list matching or packet size matching), and use the set ip next-hop verify-availability route-map configuration command selectively.
Monitoring NetFlow Policy Routing
Typically, you would use existing policy routing and NetFlow show EXEC commands to monitor these features. For more information on these show commands, refer to the policy routing and NetFlow documentation.
To display the route map Inter Processor Communication (IPC) message statistics in the RP or VIP, use the following command in EXEC mode:
Router# show route-map ipc
Displays the route map IPC message statistics in the RP or VIP.
NetFlow Configuration Examples
This section provides the following basic configuration examples:
•
•
•
NetFlow Configuration Example
The following example shows how to modify the configuration of serial interface 3/0/0 to enable NetFlow and to export the flow statistics for further processing to UDP port 0 on a workstation with the IP address of 1.1.15.1. In this example, existing NetFlow statistics are cleared to ensure accurate information when the show ip cache flow command in privileged EXEC mode is entered to view a summary of the NetFlow statistics.
configure terminalinterface serial 3/0/0ip route-cache flowexitip flow-export 1.1.15.1 0 version 5 peer-asexitclear ip flow statsThe following is a sample display of a main cache using the show ip cache flow command:
Router# show ip cache flowIP packet size distribution (230151 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.999 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000The preceding output shows the percentage distribution of packets by size range. In this display, 99.9 percent of the packets fall in the size range from 1 to 32 bytes.
IP Flow Switching Cache, 4456448 bytes65509 active, 27 inactive, 820628747 added955454490 ager polls, 0 flow alloc failuresExporting flows to 1.1.15.1 (2057)820563238 flows exported in 34485239 udp datagrams, 0 failedlast clearing of statistics 00:00:03Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)-------- Flows /Sec /Flow /Pkt /Sec /Flow /FlowTCP-BGP 71 0.0 1 49 0.0 2.5 15.8UDP-other 17 0.0 1 328 0.0 0.0 15.7ICMP 18966 6.7 10 28 72.9 0.1 22.9Total: 19054 6.7 10 28 72.9 0.1 22.9SrcIf SrcIPaddress DstIf DstIPaddress Pr TOS Flgs PktsPort Msk AS Port Msk AS NextHop B/Pk ActiveEt1/1 52.52.52.1 Fd4/0 42.42.42.1 01 55 10 37480000 /8 50 0000 /8 40 202.120.130.2 28 17.8Et1/2 52.52.52.1 Fd4/0 42.42.42.1 01 CC 10 35680000 /8 50 0000 /8 40 202.120.130.2 28 17.8Et1/2 10.1.3.2 Fd4/0 42.42.42.1 01 C0 10 11240000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 11.1.3.2 Fd4/0 42.42.42.1 01 C0 10 11570000 /0 0 0000 /8 40 202.120.130.2 28 17.7Et1/2 14.1.3.2 Fd4/0 42.42.42.1 01 C0 10 11490000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 15.1.3.2 Fd4/0 42.42.42.1 01 C0 10 11270000 /0 0 0000 /8 40 202.120.130.2 28 17.7Et1/2 12.1.3.2 Fd4/0 42.42.42.1 01 C0 10 12040000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 13.1.3.2 Fd4/0 42.42.42.1 01 C0 10 11590000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 18.1.3.2 Fd4/0 42.42.42.1 01 C0 10 12230000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 19.1.3.2 Fd4/0 42.42.42.1 01 C0 10 12640000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 16.1.3.2 Fd4/0 42.42.42.1 01 C0 10 11700000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 17.1.3.2 Fd4/0 42.42.42.1 01 C0 10 11670000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 22.1.3.2 Fd4/0 42.42.42.1 01 C0 10 11930000 /0 0 0000 /8 40 202.120.130.2 28 17.8Et1/2 23.1.3.2 Fd4/0 42.42.42.1 01 C0 10 12120000 /0 0 0000 /8 40 202.120.130.2 28 17.7Et1/1 50.50.50.1 Local 31.31.31.1 06 C0 18 200B3 /32 0 2AF8 /32 0 0.0.0.0 49 10.1Et1/0 8.8.8.8 Et0/0* 9.9.9.9 01 00 10 30000 /8 302 0800 /8 300 3.3.3.3 100 0.1
Note
Table 19 describes the significant fields shown in the flow switching cache lines of the display.
Table 20 describes the significant fields shown in the activity by protocol lines of the display.
Table 21 describes the significant fields in the NetFlow record lines of the display.
NetFlow Aggregation Configuration Examples
This section provides the following aggregation cache configuration examples:
•
•
•
•
Autonomous System Configuration Example
The following example shows how to configure an Autonomous System aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992:
Router(config)# ip flow-aggregation cache asRouter(config-flow-cache)# cache entries 2046Router(config-flow-cache)# cache timeout inactive 200Router(config-flow-cache)# cache timeout active 45Router(config-flow-cache)# export destination 10.42.42.1 9992Router(config-flow-cache)# enabledDestination Prefix Configuration Example
The following example shows how to configure a Destination Prefix aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992:
Router(config)# ip flow-aggregation cache destination-prefixRouter(config-flow-cache)# cache entries 2046Router(config-flow-cache)# cache timeout inactive 200Router(config-flow-cache)# cache timeout active 45Router(config-flow-cache)# export destination 10.42.42.1 9992Router(config-flow-cache)# enabledPrefix Configuration Example
The following example shows how to configure a Prefix aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992:
Router(config)# ip flow-aggregation cache prefixRouter(config-flow-cache)# cache entries 2046Router(config-flow-cache)# cache timeout inactive 200Router(config-flow-cache)# cache timeout active 45Router(config-flow-cache)# export destination 10.42.42.1 9992Router(config-flow-cache)# enabledProtocol Port Configuration Example
The following example shows how to configure a Protocol Port aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992:
Router(config)# ip flow-aggregation cache protocol-portRouter(config-flow-cache)# cache entries 2046Router(config-flow-cache)# cache timeout inactive 200Router(config-flow-cache)# cache timeout active 45Router(config-flow-cache)# export destination 10.42.42.1 9992Router(config-flow-cache)# enabledSource Prefix Configuration Example
The following example shows how to configure a Source Prefix aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992:
Router(config)# ip flow-aggregation cache source-prefixRouter(config-flow-cache)# cache entries 2046Router(config-flow-cache)# cache timeout inactive 200Router(config-flow-cache)# cache timeout active 45Router(config-flow-cache)# export destination 10.42.42.1 9992Router(config-flow-cache)# enabledSetting a NetFlow Minimum Prefix Mask for Router-Based Aggregation Examples
This section provides the following NetFlow minimum prefix mask aggregation cache configuration examples:
•
•
•
Prefix Aggregation Scheme Example
!ip flow-aggregation cache prefixmask source minimum 24mask destination minimum 28Destination-Prefix Aggregation Scheme Example
!ip flow-aggregation cache destination-prefixmask destination minimum 32!Source-Prefix Aggregation Scheme Example
ip flow-aggregation cache source-prefixmask source minimum 30!NetFlow Policy Routing Example
The following example configures CEF and NetFlow. It also configures policy routing to verify that next hop 50.0.0.8 of route map named test is a CDP neighbor before the router tries to policy route to it.
If the first packet is being policy routed via route map test sequence 10, the subsequent packets of the same flow always take the same route map test sequence 10, not route map test sequence 20, because they all match or pass access list 1 check.
ip cefinterface ethernet0/0/1ip route-cache flowip policy route-map testroute-map test permit 10match ip address 1set ip precedence priorityset ip next-hop 50.0.0.8set ip next-hop verify-availabilityroute-map test permit 20match ip address 101set interface Ethernet0/0/3set ip tos max-throughput
