How to configure and verify Cisco Netflow

The netfllow is the network protocol which is developed by Cisco for the monitoring and collection of data traffic flow data generated by the Netflow enabled router and switches. It is mainly used by the IT professionals to analyze the network traffic flow as well as volume to find out where the traffics are coming from, where it was going to as well as the quantity of traffic which is being generated. The Netflow enabled router export the traffic statistics as the Netflow record that is then gathered by the Netflow collector. Thereby, a collector can be a real traffic analysis as well as presentation to user and also can take a form of the software or hardware appliance. This section will guide you how to configure and verify the Cisco Netflow and its version 5, 9 and its local retrieval.

6.11 configure and verify Cisco Netflow

The network visibility is mostly the indispensable tool for the network administrator. The network visibility will be done through day to day troubleshooting, application monitoring, QoS traffic views, compliance issues or identifying the security gaps, bandwidth capacity planning and understanding the network utilization. For that, the Netflow offer administrator with the essential data to understand the network traffic movement. In historic view, this Netflow is mainly used to understand the network behavior, help to resolve and reduce the problems related to the application performance, bandwidth, as well as improper traffic classification. It also enables the effective network operation which will reflect in lower cost as well as drive to the higher business revenues via better network infrastructure utilization.

The Cisco IOS Netflow will effectively offer the key set of service for the IP application such as usage-based network billing, security, network monitoring, denial of the service monitoring abilities, and network traffic accounting. The Netflow offers the valuable information about the applications and network users, traffic routing routing and peak usage times. The Cisco introduced a Netflow and it is the leader in the IP traffic flow technologies.

The Netflow is very transparent to an existing network such as application software, end stations and also network devices such as LAN switches. The Netflow will perform independently on every internetworking device and that not required operational of the each network router. By using the NDE- Netflow data export, export the data to the remote workstation for gathering data as well as for processing further. The network planners will selectively invoke this NDE on the per-subinterface or router basis to acquire the performance of traffic, accounting or control benefits in the certain network locations.

To ensure the proper functionality, remember the below things to configure the device:

1. The Netflow configuration will vary a little bit per hardware model
2. The Netflow has to be enabled for the ingress traffic on an interface only and offering both egress and ingress statistics can efficiently doubles the reported bandwidth amount for the existing flow and it is not required in most of the cases.
3. An active timeout must always set to 1 minute interval. This value indicates the device consumed amount of time to flush a cache of the information pertaining to the active flow conversations and also ensures the accurate rend as well as alarm information.
4. The Netflow is mainly depends on the 7 key field. In case, any 1 of the field is different, then the new flow record can be created in a flow cache table such as the destination IP address, source IP address, ToS byte, layer 3 protocol type, source port number, input logical interface and destination port number.
5. It is the very best source Netflow export from the interface which can never go down, including loopbacl0.
6. Enable the Netflow on the each layer 3 interface for the complete visibility

To configure the Netflow, first step is required and all other steps are optional :

Step 1: Enable Netflow

First, configure a router for the IP routing to enable the Netflow. Then after configuring the IP routing, make use of the below commands to configure it.

1. Specify interface and also enter an interface configuration mode.

Command:

Or

2. Enable Netflow for the IP routing:

Command:

Step 2: export the Netflow statistics

In this step the Netflow information us exported to the network management application. So to configure a router to export the Netflow statistic in a Netflow cache to the workstation wen the flow expires, make use of the below command:

Command 1:

Command 2:

Step 3: customize entry number in a Netflow cache

Generally, the Netflow cache will fulfill all your requirements. Although, you can also decrease or increase the entry numbers in a cache to fulfill the requirements of the Netflow traffic rate. As default, the cache entry is 64 flow. Every cache entry need about storage of 64 bytes. To customize the entry number in a Netflow cache, make use of the below global configuration mode command:

Step 4: Manage the Netflow statistics

In this configuration, you can display, clear Netflow statistics. The Netflow statistic comprises of the IP packet size distributions, information to the IP flow cache and also flow information such as total flow, protocol and flows per second. To mange the Netflow statistics make use of the given privileged EXEC mode command as required:

Below command helps to display a Netflow statistics:

The Below command clears a Netflow statistics:

Verification:

To verify information about aggregation cache, make use of the below command in the EXEC mode:

To confirm the data export, make use of the below command in the EXEC mode:

Given below is the example of Netflow configuration:

6.11.a Netflow v5, v9

The network flow is defined in so many ways. The Cisco Netflow v5 defines the flow as the unidirectional packet sequence which all share the below 7 values such as:

• Internet protocol service type
• IP protocol
• Source IP address
• Destination port for the TCP or UDP
• Ingress interface
• Destination port for the TCP, or UDP
• Destination IP address

In the below diagram, the Netflow data are exported from the certain interface which require to be monitored from switching or routing device in a network. That Netflow data are exported to the centralized collector analyzer of Netflow which process and also generates the reports.

The traditional Netflow or Netflow v5 is used widely and also supports AS - autonomous system reporting and also some additional fields. These flows are mostly calculated when it comes into the interface and also outbound traffics are reported by using the inbound flow from another interface. Hence, it advised that the netfow v5 is enabled on all the device interface or else the outbound utilization of some of the interfaces can be understated. A packet formats are fixed and always be same. So that it is easy to decipher for the most network traffic and Netflow collection.

Given below is the set of commands which are provided on the Cisco routers to enable the Netflow v5 on a fastethernet0/1 interface and also export it to the machine of 10.199.15.103 on port 2055.

Perform the below task to verify the configuration:

Netflow v9:

The basic output of the Netflow is the flow record. There are several various formats for the flow records is evolved when the Netflow becomes matured. The very most recent evolution of a flow record format of the Netflow is called as the Netflow version9 format, that is a basis for the IETF standard which is the template based. The template will ofeer the extensible design to a record format, and the feature which has to allow the future enhancement to Netflow service without any need of concurrent changes to a basic format of flow records. By using the templates, it offers variety of benefits such as follows:

• The Netflow v9 is the information export through IETF standard mechanism.
• The new features also added to the Netflow very quickly without breaking the any current implementations.
• The Netflow is the future done against the developing protocols or new protocols, hence a Netflow v9 format is very adaptive to offer support for it.
• The 3rd party business partner who produced the application which offer display or collector services for the Netflow cannot be needed to recompile the applications every time the new feature of Netflow is added, rather than using the external data file which document a known template format.

The Netflow v9 is the most flexible Netflow technology. This flexible type Netflow accommodates the custom fields, including IPv6, NBAR protocols, VLAN ID, MPLS labels, real time performance of the media flows, multicast IP traffic and much more.

Following is the set of command which are provided on the Cisco routers to enable the flexible Netflow on a fastethernet0/1 interface as well as export to the 10.199.15.103 machine on the port 2055.

Verify Netflow v9 configuration:

Once the Netflow is configured, then the Netflow packet is sent to a designated collector or server. The Netflow will bring many thousands of the flows per second based on the network size and traffic. This tool which collects the Netflow packet make you to understand and helps to manage the bandwidth.

6.11.b Local retrieval

The Cisco Netflow MIB supported on a Cisco router offers real time access to the limited number of fields in a flow cache. The SNMP has used to gather network information in the earlier days. The SNMP allows retrieval of the critical information from the network elements such as workstation, switches and router. A Netflow MIB feature also uses the SNMP, to gather the Netflow statistics and to configure the Netflow. This MIB feature allows the Netflow statistics and also other Netflow data for a managed device on the system that has to be retrieved by the SNMP. Specify the retrieval of the Netflow information from the managed device either by entering the SNMP command from an NMS workstation or by entering the commands on the managed device to configure a router through the MIB. Suppose, the information of the Netflow is configured from an NMS workstation, then no access to a router is needed and all the configuration will be performed through SNMP. A Netflow MIB request for information is mainly sent from the NMS workstation through the SNMP, to a router and it is retrieved from a router. That the information will be viewed or stored, since allowing the information of the Netflow to be easily transported and accessed across the multi-vendor type programming environment.

6.11.c Export ( configuration only)

The Netflow record is traditionally exported by using the UDP and collected by using the Netflow collector. An IP address of a Netflow collector and a destination UDP port has to be configured on a sending router. For many reasons, a router will maintain track of flow record which already exported, hence if the Netflow packets are dropped because of the packet corruption or network congestion. So that the modern Netflow implementation uses the SCTP - stream control transmission protocol to export the packets to offer protection against the loss of packets and also assures that the Netflow v9 templates is received before exporting the related record. The Netflow export only uses the network backbone link, packet loss can be negligible.

Provide the below command to enable the Netflow export:

Then, enable 'n' Netflow on the each layer 3 interface for that you like to monitor traffic for:

Interface <interface>

Ip flow ingress

By analyzing the data offered by the Netflow the network administrators can easily find out the things such as destination and source of the traffic, causes of the congestion and class of service. The Netflow is becomes the de-factto industry standard and also supported by the platforms like Cisco including 3com/HP, Netgear, Huawaei, Ericsson, Alcatel-lucent, and juniper. Cisco developed this flow technology, which allows bandwidth monitoring of the network. It allows extremely granular as well as accurate bandwidth monitoring by recording the network traffic into a device cache. This Netflow v 5 and v9, local retrieval and export configuration will guide to perform the tasks well.