Catalyst 4500 Series Switch Software Configuration Guide, Release IOS XE 3.3(0)XO

Configuring Flexible NetFlow

---

Flow is defined as a unique set of key fields attributes, which might include fields of packet, packet routing attributes, and input and output interface information. A NetFlow feature defines a flow as a sequence of packets that have the same values for the feature key fields. Flexible NetFlow (FNF) allows you to collect and optionally export a flow record that specifies various flow attributes. NetFlow collection supports IP, IPv6 and Layer 2 traffic.

Note This chapter provides Catalyst 4500 switch specific information. For platform independent configuration and command information refer to the following links

Cisco IOS Flexible NetFlow Configuration Guide:

http://www.cisco.com/en/US/partner/docs/ios/fnetflow/configuration/guide/12_4t/fnf_12_4t_book.html
Cisco IOS Flexible NetFlow Command Reference:

http://www.cisco.com/en/US/partner/docs/ios/fnetflow/command/reference/fnf_book.html

Note When IP routing is disabled, on the interface configured with NetFlow Lite, packets are not received on NetFlow collector. Enable IP routing for the NetFlow collector to work.

The following items apply to the Catalyst 4500 series switch:

1. The Catalyst 4500 series switch supports ingress flow statistics collection for switched and routed packets; it does not support Flexible Netflow on egress traffic.

2. Supervisor Engine 8-E supports a 100,000 entry hardware flow table, which is shared across all the ports and VLANs on the switch. To limit the number of table entries on a given interface or VLAN, enter the cache entries number command.

The following example illustrates how to configure the flow monitor m1 cache to hold 1000 entries. With this configuration, interface gig 3/1 can create a maximum of 1000 flows and interface gig 3/2 can create a maximum of 1000 flows:

3. Flow collection is supported on multiple targets (Port, VLAN, per-port per-VLAN (FNF can be enabled on a specific VLAN on a given port)) and on a port-channel (FNF is configured on the port-channel interface, rather than individual member ports).

Note The switch does not support tunnels and SVI statistics.

4. 64 unique flow record configurations are supported.

5. Flow QoS/UBRL and FNF cannot be configured on the same target. (For information on Flow-based QoS, see the section Flow-based QoS.)

6. 14,000 unique IPv6 addresses can be monitored.

7. On a given target, one monitor per traffic type is allowed. However, you can configure multiple monitors on the same target for different traffic types.

For example, the following configuration is allowed:

The following configuration is not allowed:

8. On a given target monitoring Layer 2 and Layer 3, simultaneous traffic is not supported:

!

9. Selection of Layer 2 and Layer 3 packet fields in a single flow record definition is not allowed. However, ingress 802.1Q VLAN Id of packet and Layer 3 packet field selection is allowed.

10. In order to attach a monitor to port or port-vlan targets, a flow record matching on ingress 802.1Q VLAN Id as key field, must match on input interface also as key field.

11. Only permanent and normal flow cache types are supported.

12. Supervisor Engine 8-E does not support predefined records like traditional routers (record neflow ipv4 original-input).

13. Supervisor Engine 8-E does not support flow based sampler.

14. On VLAN interfaces, when you use the interface option with the Cos, Tos, TTL or Packet length options, the system displays inaccurate results for the interface input field.

15. The configuration of the flow exporter does not support the option output features.

16. Flow aging in flow cache is controlled through active and in-active timer configuration. The minimum for active and in-active aging timers is 5 seconds. The timers must be in units of 5 seconds.

Note Flows in the hardware table are deleted after 5 seconds of in-activity irrespective of the active or in-active timer configuration values. This allows you to create new hardware flows quickly.

17. First and Last-seen flow timestamp accuracy is within 3 seconds.

18. 2048 Flow monitors and records are supported.

• When TTL is configured as a flow field, the following values are reported for a given packet TTL value. Table 59-1 lists the packet TTL and reported values.

• When packet length is configured as a flow field, the following values are reported for a given packet length value. Table 59-2 lists the packet length and reported values.

l

The following table lists the options available through FNF and the supported fields.