NetFlow 102 – FNF – Flexible NetFlow
Netflow configuration is different by platform and IOS version. Initially, Cisco IOS supported what is now known as “Traditional/Original Netflow(TNF)”, but newer versions of the IOS support “Flexible Netflow (FNF). Support for Traditional Netflow configuration is being dropped from neweer IOS versions, so if available, use Flexible Netflow configuration on IOS and XR devies. Also, some devices support IPv6 flow monitoring only via FNF configuration. FNF and TNF can coexist on the same device. For more details about TNF, see NetFlow 101 – TNF – Traditional NetFlow.

How FNF works

FNF can be largely seen as a different way of configuring netflow. It is more “flexible” but in the end it accomplishes the same thing as TNF. FNF is enabled when a netflow monitor is applied on an interface, but there are a few prerequesits that need to be defined prior to this:

Create NetFlow Record

Pre-defined Flow Records

Some IOS platforms have predefiend Flow Records. You can verify them with this command:
1
R#show flow record
Copied!

Custom Flow Records

On most platforms you can also define your own records:
1
R(config)#
2
!IPv4 record, similar to standard netflow v5 format
3
flow record FLOW-RECORD-IPV4
4
match ipv4 tos
5
match ipv4 protocol
6
match ipv4 source address
7
match ipv4 destination address
8
match transport source-port
9
match transport destination-port
10
match interface input
11
collect ipv4 dscp
12
collect ipv4 ttl minimum
13
collect ipv4 ttl maximum
14
collect transport tcp flags
15
collect interface output
16
collect counter bytes
17
collect counter packets
18
collect timestamp sys-uptime first
19
collect timestamp sys-uptime last
20
21
!IPv6 record, similar to standard netflow v5 format
22
flow record FLOW-RECORD-IPV6
23
match ipv6 dscp
24
match ipv6 protocol
25
match ipv6 source address
26
match ipv6 destination address
27
match transport source-port
28
match transport destination-port
29
match interface input
30
collect transport tcp flags
31
collect interface output
32
collect counter bytes
33
collect counter packets
34
collect timestamp sys-uptime first
35
collect timestamp sys-uptime last
Copied!

Flow Exporter

1
!Define the exporter
2
R(config)# flow exporter FLOW-EXPORTER
3
!Configure the destination of the netflow traffic
4
R(config-flow-exporter)# destination NETFLOW-COLLECTOR-IP
5
!Configure the source of the netflow traffic
6
R(config-flow-exporter)# source INTERFACE
7
!Configure the port listening on the destination
8
R(config-flow-exporter)# transport udp PORT
9
!Configure the type of protocol used for tranport
10
R(config-flow-exporter)# export-protocol {netflow-v5|netflow-v9|ipfix}
11
!The following command will enable qos marking of the netflow packets based on output interface settings
12
R(config-flow-exporter)# output-features
Copied!

Flow Monitors

1
!Define the monitor
2
R(config)# flow monitor FLOW-MONITOR
3
!Configure the record type using custom or pre-defined records.
4
R(config-flow-monitor)# record {FLOW-RECORD-IPV4|FLOW-RECORD-IPV6|netflow ipv4 original-input}
5
!Tie the monitor to an exporter profile
6
R(config-flow-monitor)# exporter FLOW-EXPORTER
7
!Configure the caching parameters. Default: active = 60 sec, inactive: 15 sec.
8
R(config-flow-monitor)# cache timeout active SEC
9
R(config-flow-monitor)# cache timeout inactive SEC
Copied!
If you want to enable netflow for both IPv4 and IPv6 you will need 2 different monitors, one for an IPv4 Flow Record, and one for an IPv6 Flow Record.

Flow samplers (optional)

1
R(config)# sampler SAMPLER-1
2
! Random does random sampling. Deterministic does periodcal sampling (less overhead)
3
R(config-sampler)# mode {deterministic|random} 1 out-of WINDOW-SIZE
4
!Default: by packet
5
R(config-sampler)# granularity {connection|packet}
Copied!

Apply on the appropriate interface

1
!On each interface that should be enabled for Netflow caching:
2
R(config)# interface INTERFACE-NAME
3
R(config-if)# {ip|ipv6} flow monitor FLOW-RECORD [sampler SAMPLER-NAME] [multicast|unicast] {input|output}
4
!Without specifying unicast or multicast, the rotuer will performan netflow operations on both.
5
!The input/output will keyword will monitor incoming/outgoing traffic only on the interface.
6
!You will need to run the command twice (once in each direction) to perfrom netflow for incoming and outgoing traffic
Copied!
Last modified 24d ago