Overview
Flexible NetFlow consists of components that can be used together in several variations to perform traffic analysis and data export.
Also make sure to allow UDP port 9995 from the firewall.
First login on the device then run the given steps
Steps of configuration
Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# flow export seceon Switch(config-flow-exporter)# destination CCE_IP_Address Switch(config-flow-exporter)# transport udp 9995 Switch(config-flow-exporter)# exit Switch(config)# flow record seceon Switch(config-flow-record)# match ipv4 source address Switch(config-flow-record)# match ipv4 destination address Switch(config-flow-record)# match ipv4 protocol Switch(config-flow-record)# match transport source-port Switch(config-flow-record)# match transport destination-port Switch(config-flow-record)# collect counter byte long Switch(config-flow-record)# collect counter packet long Switch(config-flow-record)# collect timestamp absolute first Switch(config-flow-record)# collect timestamp absolute last Switch(config-flow-record)# exit Switch(config)# flow monitor MonitorSeceon Switch(config-flow-monitor)# record seceon Switch(config-flow-monitor)# exporter seceon Switch(config-flow-monitor)# exit Switch(config)# interface range InterfaceName Switch(config-if)# ip flow monitor MonitorSeceon input Switch(config-if)# end
Note-For Showing interfaces run the command:-
1-do show Interfaces and after that interfaces show in gigabyte then inter the active interfaces in gigabyte range
FINISHING UP
At this point the Cisco device is configured and exporting NetFlow. Depending on the configured timeouts, it could take some minutes for session traffic to start arriving and being processed. If traffic fails to arrive at your collector, there are a few things check:
First, make sure that your NetFlow collector is listening on the correct port (UDP 9995) and that any firewalls in between (particularly on the host running the collector) allow the NetFlow packets to pass.
Second, double-check the Exporter configuration and ensure the collector IP address listed is correct and routable. You can verify the flow of session records using a packet capture utility such as Wireshark or TCPdump.
Third, make sure the configuration includes all the data needed to store full network session records: typically, collectors require IP addresses, protocol, port numbers, and byte and packet counts.
Finally, if none of the above troubleshooting methods worked, contact your vendor’s support.
Reference: https://www.flowtraq.com/configuring-flexible-netflow-export-cisco-routers/
Verification:
STEP1: Login to UI >> SYSTEM>> LOGS AND FLOWS COLLECTION STATUS .
STEP 2: >> LOGS AND FLOWS COLLECTION STATUS .
STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.
Troubleshooting for common error
Error 1: Flow Monitor: Flow Monitor 'monitor1' couldn't be added. Please activate a sampler with the monitor in this case go through the following configuration.
Switch(config)# flow exporter export1 Switch(config-flow-exporter)# destination 10.0.101.254 Switch(config-flow-exporter)# transport udp 2055 Switch(config-flow-exporter)# template data timeout 60 Switch(config-flow-exporter)# exit Switch(config)# flow record record1 Switch(config-flow-record)# match ipv4 source address Switch(config-flow-record)# match ipv4 destination address Switch(config-flow-record)# match ipv4 protocol Switch(config-flow-record)# match transport source-port Switch(config-flow-record)# match transport destination-port Switch(config-flow-record)# collect counter bytes long Switch(config-flow-record)# collect counter packets long Switch(config-flow-record)# collect timestamp sys-uptime first Switch(config-flow-record)# collect timestamp sys-uptime last Switch(config-flow-record)# exit Switch(config)# sampler SampleTest Switch(config-sampler)# mode random 1 out-of 100 Switch(config-sampler)# exit Switch(config)# flow monitor monitor1 Switch(config-flow-monitor)# cache timeout active 300 Switch(config-flow-monitor)# cache timeout inactive 120 Switch(config-flow-monitor)# record record1 Switch(config-flow-monitor)# exporter export1 Switch(config-flow-monitor)# exit Switch(config)# interface GigabitEthernet1/0/1 Switch(config-if)# ip flow monitor monitor1 sampler SampleTest input Switch(config-if)# end
Add label