Netflow is the collection of flow of networks. It is a Cisco proprietary protocol used to collect the source and destination IP along with the bytes it consumes, totally it is a collection of flow of packets and export to the Netflow collector. Netflow collector is the server where the application is running ex Solarwinds, Logic Monitor etc.. It is a one way traffic, the routers or switches configured with Netflow would send the traffic to the collector as per the threshold timers set in the devices. There was no trap like feature which is available in snmp where the traffic has been initiated from the server end.
Netflow configuration has been divided into three parts - Flow record, Flow Exporter and Flow Monitor. As the name itself Flow record is the collection of information where it collects the flow. It defines the information that NetFlow gathers, such as packets in the flow and the types of counters gathered per flow. Flow record is the combination of the “match” and “collect” commands that tell the router which fields to include in the outgoing NetFlow PDU. Flow exporter is used to send the information to the server, both the collector and exporter parameters are to be called in the flow monitor. Finally it should be applied on the Interface where you are interested to monitor the traffic .Given below are the examples of Netflow configuration in Cisco 3850 catalyst switch.
sw3850(config)# flow record RECORD
sw3850(config-flow-record)# description NetFlow record format to send to StealthWatch
sw3850(config-flow-record)# match ipv4 ttl
sw3850(config-flow-record)# match ipv4 tos
sw3850(config-flow-record)# match ipv4 protocol
sw3850(config-flow-record)# match ipv4 source address
sw3850(config-flow-record)# match ipv4 destination address
sw3850(config-flow-record)# match transport source-port
sw3850(config-flow-record)# match transport destination-port
sw3850(config-flow-record)# match interface input
sw3850(config-flow-record)# collect interface output
sw3850(config-flow-record)# collect counter bytes long
sw3850(config-flow-record)# collect counter packets long
sw3850(config-flow-record)# collect timestamp absolute first
sw3850(config-flow-record)# collect timestamp absolute last
2. Create a Flow Exporter (specify where/how NetFlow is to be sent)
sw3850(config)#flow exporter EXPORTER
sw3850(config-flow-exporter)#description Export NetFlow to StealthWatch
sw3850(config-flow-exporter)#destination <fc_collector_IP_address>
sw3850(config-flow-exporter)#source <interface> → (e.g. use a Loopback)
sw3850(config-flow-exporter)#transport udp 2055
3. Create a Flow Monitor (tie the Flow Record to the Flow Exporter)
sw3850(config)#flow monitor MONITOR
sw3850(config-flow-monitor)#record RECORD
sw3850(config-flow-monitor)#exporter EXPORTER
sw3850(config-flow-monitor)#cache timeout active 60
4. Assign Flow Monitor to selected interfaces
Repeat this step on every interface you are interested in monitoring traffic for.
sw3850(config)#interface <interface> → (e.g. VLAN1 or g2/1)
sw3850(config-if)#ip flow monitor MONITOR input
Validate configuration:
show flow record RECORD
show flow monitor MONITOR statistics
show flow monitor MONITOR cache