Updating....
2019-11-11 version1
Creating a Flow Record
Perform this task to configure a customized flow record.
Customized flow records are used to analyze traffic data for a specific purpose. A customized flow record must have at least one match criterion for use as the key field and typically has at least one collect criterion for use as a nonkey field.
There are hundreds of possible permutations of customized flow records. This task shows the steps that are used to create one of the possible permutations. Modify the steps in this task as appropriate to create a customized flow record for your requirements.
1. enable
2. configure terminal
3. flow record record-name
4. description description
5. match {ip | ipv6} {destination | source} address
6. Repeat Step 5 as required to configure additional key fields for the record.
7.
8. Repeat the above step as required to configure additional nonkey fields for the record.
9. end
10. show flow record record-name
11. show running-config flow record record-name
Configuring a Flow Monitor for IPv4 or IPv6 Traffic Using the Predefined Record
To configure a flow monitor for IPv4/IPv6 traffic using the Flexible NetFlow "NetFlow IPv4/IPv6 original input" predefined record for the flow monitor, perform the following required task.
Each flow monitor has a separate cache assigned to it. Each flow monitor requires a record to define the contents and layout of its cache entries. The record format can be one of the predefined record formats, or an advanced user may create his or her own record format using the collect and matchcommands in Flexible NetFlow flow record configuration mode.
 Note |
You must remove a flow monitor from all of the interfaces to which you have applied it before you can modify the record format of the flow monitor. |
1. enable
2. configure terminal
3. flow monitor monitor-name
4. description description
5. record netflow {ipv4 | ipv6} original-input
6. end
7. show flow monitor [[name] monitor-name [cache [format {csv | record | table}]][statistics]]
8. show running-config flow monitor monitor-name
Configuring a Flow Exporter for the Flow Monitor
Perform this optional task to configure a flow exporter for the flow monitor in order to export the data that is collected by Flexible NetFlow to a remote system for further analysis and storage.
Flow exporters are used to send the data that you collect with Flexible NetFlow to a remote system such as a NetFlow Collection Engine. Exporters use UDP as the transport protocol and use the Version 9 export format.
| Note |
Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor. You can export to a destination using either an IPv4 or IPv6 address. |
| Note |
When you configure an exporter, configure the exporter in such a way that the source interface is defined as a WAN interface. This configuration helps you prevent any unpredictable behavior because the NAT is not applied on the packets. |
1. enable
2. configure terminal
3. flow exporter exporter-name
4. description description
5. destination {hostname | ip-address} [vrf vrf-name]
6. export-protocol {netflow-v5 | netflow-v9 | ipfix}
7. transport udp udp-port
8. exit
9. flow monitor flow-monitor-name
10. exporter exporter-name
11. end
12. show flow exporter exporter-name
13. show running-config flow exporter exporter-nam
Creating a Flow Monitor
Perform this required task to create a customized flow monitor.
Each flow monitor has a separate cache assigned to it. Each flow monitor requires a record to define the contents and layout of its cache entries. These record formats can be a user-defined format. An advanced user can create a customized format using the flow record command.
If you want to use a customized record, you must create the customized record before you can perform this task. If you want to add a flow exporter to the flow monitor for data export, you must create the exporter before you can complete this task.
| Note |
You must use the no ip flow monitor command to remove a flow monitor from all of the interfaces to which you have applied it before you can modify the parameters for the record command on the flow monitor. |
1. enable
2. configure terminal
3. flow monitor monitor-name
4. description description
5. record {record-name}
6. cache {timeout {active} seconds | { normal }
7. Repeat Step 6 as required to finish modifying the cache parameters for this flow monitor.
8. exporter exporter-name
9. end
10. show flow monitor [[name] monitor-name [cache [format {csv | record | table}]] ]
11. show running-config flow monitor monitor-nam
Applying a Flow Monitor to an Interface
Before it can be activated, a flow monitor must be applied to at least one interface. Perform this required task to activate a flow monitor.
1. enable
2. configure terminal
3. interface type number
4. {ip | ipv6} flow monitor monitor-name {input | output}
5. Repeat Steps 3 and 4 to activate a flow monitor on any other interfaces in the device over which you want to monitor traffic.
6. end
7. show flow interface type number
8. show flow monitor name monitor-name cache format record