In this blog, we’ll cover the NetFlow configuration for Nexus 5600 switches. To configure NetFlow, ensure you have a VRF (virtual routing and forwarding) instance configured first, as it doesn’t work if applied under a VLAN interface or physical interface as a source when we configure the flow exporter.
The below configuration includes separate Layer 2 and Layer 3 information divided by the flow record and flow monitor, but still applied under the same interface. These configurations have different responsibilities. The “L2rr” flow record will be responsible for a Layer 2 information, which includes information about MAC addresses and VLANs. “L3rr” will bring us information related to Layer 3, which includes conversations between hosts or IP addresses.
The configuration can still vary based on your version of IOS. Layer 3 information can be taken from a switch that supports Layer 3 forwarding, which in our case is the Nexus 5600.
Here are steps to configure NetFlow on a Nexus 5600:
- Create two flow records, for Layer 2 and Layer 3 respectively.
- Create a common exporter for both L2/L3 configurations.
- Create two flow monitors; each will have separate flow records but same flow exporter.
- Create a default sampler for each of the flow monitors.
- Apply two created flow monitors under same interface.
Name your flow record for Layer 2 (e.g. L2rr):
flow record L2rr description Layer2 information match datalink dot1q vlan input match datalink dot1q vlan output match datalink mac source address input match datalink mac source address output collect flow sampler collect counter bytes !
Name your flow record for Layer 3 (e.g. L3rr):
flow record L3rr match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect ipv4 version collect counter bytes long collect counter packets long collect timestamp sys-uptime first collect timestamp sys-uptime last !
Name your flow exporter (e.g. L2):
flow exporter L2 destination xxx.xxx.xxx.xxx use vrf-management source mgmt0 transport udp 2055 template data timeout 60 !
Name your flow monitor for Layer 2 (e.g. L2m):
flow monitor L2m description Monitoring Layer2 exporter L2 record L2rr !
Name your flow monitor for Layer 3 (e.g. L3m):
flow monitor L3m description Monitoring Layer3 exporter L2 record L3rr ! !
Name your sampler (e.g. L2sampler):
sampler L2sampler mode deterministic 1 out-of 100 ! !
Apply configured flow monitors under required interface:
interface Ethernet0/1 ip flow monitor L3m sampler L2sampler input ip flow monitor L2m sampler L2sampler input
The main purpose of this blog was to highlight a difference between two layers and to define what can be applied under each of them to avoid any conflicts during configuration itself. If you’re having difficulty, give us a call. We’ll be glad to walk you through it.