
The Cisco Catalyst 4500E is one of the latest kids on the block, so the age old question in our world is, “How do you configure NetFlow on this?”
Well, I was fortunate enough to be able to work with one of Cisco’s engineers on working the kinks out of the configuration, and getting the following working Flexible NetFlow configuration:
--------------------------------------------------------
flow record r1 match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect routing forwarding-status collect transport tcp flags collect interface output collect counter bytes long collect counter packets long collect timestamp sys-uptime first collect timestamp sys-uptime last ! ! flow exporter e1 destination 10.10.20.2 source VLAN1 transport udp 9996 template data timeout 60 ! ! flow exporter e2 destination 10.10.30.2 source VLAN1 transport udp 9996 template data timeout 60 ! ! flow monitor m1 record r1 exporter e1 exporter e2 cache timeout inactive 30 cache timeout active 60 cache entries 1000 -------------------------- vlan configuration 301 ip flow monitor m1 input or interface x/x ip flow monitor m1 input --------------------------------------------------------
The Flow Record includes the key fields that you will be exporting — the ‘match’ statements, and the non-key fields in the flow record — the ‘collect’ statements.
The fields included in this Flow Record example are the basic fields to export to and report by a NetFlow collector and analyzer tool. More information on other fields that can be added can be found on this Cisco 4500 FNF configuration page.
The Flow Exporter defines where and how to export to your NetFlow Collector. As always with Flexible NetFlow, you can export flows to multiple collectors. In our example, we have two Flow Exporters, ‘flow exporter e1’ and ‘flow exporter e2’.
The definitions in the Flow Exporter include ‘destination’ which is the IP Address of your NetFlow collector, ‘source’ which is the interface exporting the flows from the 4500, ‘transport’ (optional) which defines which udp port you are exporting to and the collector is listening on, and ‘template data timeout’ defines the frequency that flow templates are exported.
Flow Monitor brings the flow records and flow exporters together and adds your timeout values. This provides for one command to set per interface.
Which brings us to the interface level, and at this level, you enter the configuration mode for the interface, and then add the ‘ip flow monitor m1 input’ command to enable FNF for that interface.
Once this configuration is completed, and your NetFlow collector is receiving flows from the 4500, your reporting options are endless.
Do you own Cisco 4500E’s and are you exporting FNF? We would love to hear your comments.