How-To Configure NetFlow
Copy-paste flow configs: pick a vendor and platform, set your collector address and a few options, and copy a ready-to-paste NetFlow, sFlow, IPFIX, or NetStream exporter configuration.
Platform
NetFlow v9Comprehensive dual-record IN/OUT build with TrustSec SGT, MAC/VLAN, and TCP flags (QuantumFlow style).
Collector & interface
Default for NetFlow v9: 2055
Options
flow record NF_RECORD_IN description Input NetFlow Record match ipv4 tos match ipv4 ttl match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input match flow direction match datalink mac source address input match datalink mac destination address input match datalink vlan input match flow cts source group-tag match flow cts destination group-tag collect interface output collect counter bytes long collect counter packets long collect timestamp absolute first collect timestamp absolute last collect transport tcp flags flow record NF_RECORD_OUT description Output NetFlow Record match ipv4 tos match ipv4 ttl match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface output match flow direction match datalink mac source address input match datalink vlan output match flow cts source group-tag match flow cts destination group-tag collect interface input collect counter bytes long collect counter packets long collect timestamp absolute first collect timestamp absolute last collect transport tcp flags flow exporter NF_FLOW_EXPORTER description to-quantumflow destination 192.0.2.50 transport udp 2055 template data timeout 30 option interface-table timeout 30 option cts-sgt-table timeout 30 flow monitor NF_RECORD_IN_FLOW_MONITOR exporter NF_FLOW_EXPORTER cache timeout inactive 10 cache timeout active 10 cache timeout update 10 record NF_RECORD_IN flow monitor NF_RECORD_OUT_FLOW_MONITOR exporter NF_FLOW_EXPORTER cache timeout inactive 10 cache timeout active 10 cache timeout update 10 record NF_RECORD_OUT
Fine print & caveats
- match fields are flow keys (flows are uniquely identified by them); collect fields are non-key data attached to each flow.
- match flow cts source/destination group-tag only populate when Cisco TrustSec (SGT) is deployed and tags are propagated/enforced.
- Applying NF_RECORD_IN as input AND NF_RECORD_OUT as output on the same path counts the same traffic twice — see the duplicate-flow diagram below.
- Setting a VRF on the exporter destination reaches the collector over that VRF; leave the VRF field blank to use the global routing table.
- template data timeout and option ...-table timeout control how often NetFlow v9 templates and ID-to-name tables are re-sent to the collector.
! Copy this and apply to each INGRESS interface interface GigabitEthernet1/0/1 ip flow monitor NF_RECORD_IN_FLOW_MONITOR input ! ! Copy this and apply to each EGRESS interface interface GigabitEthernet1/0/1 ip flow monitor NF_RECORD_OUT_FLOW_MONITOR output
Monitoring direction — avoid double-counting
Don’t — ingress + egress on the same path
Do — ingress metering on both ports
Configuration notes (Cisco IOS-XE — Flexible NetFlow + TrustSec)
What the IOS-XE Flexible NetFlow + TrustSec config above actually does.
match sets key fields: flows are uniquely identified by them. collect sets non-key fields: extra data attached to a flow that does not define it.
match ipv4 tos / ttl / protocol — IP header type-of-service (QoS/DSCP), time-to-live, and the L4 protocol number.
match ipv4 source / destination address + match transport source-port / destination-port — the classic 5-tuple that identifies a conversation.
match interface input / collect interface output — which physical port the flow entered and left on.
match flow direction — tags each flow as ingress or egress so one collector can tell the IN and OUT records apart.
match datalink mac source/destination address input and match datalink vlan input/output — layer-2 MAC addresses and VLAN seen on the frame.
match flow cts source/destination group-tag — Cisco TrustSec Security Group Tags (SGT). Only populated when TrustSec is deployed and tags are propagated/enforced.
match application name — the NBAR2-classified application (requires application visibility/AVC support).
collect counter bytes/packets long — per-flow byte and packet totals using 64-bit ("long") counters.
collect timestamp absolute first/last — wall-clock time the flow started and was last seen.
collect transport tcp flags — the OR of TCP flags observed (SYN/ACK/FIN/RST...), useful for session analysis.
destination ... vrf NAME — collector IP, reached over the named VRF. Drop vrf to use the global routing table.
source Loopback12 — sources export packets from a stable loopback so the collector always sees the same exporter IP.
transport udp 2055 — UDP port the collector listens on (2055 is the common QuantumFlow / NetFlow v9 port).
template data timeout 30 — re-send the NetFlow v9 template every 30s so a restarted collector can decode flows.
option interface-table / cts-sgt-table / application-table timeout 30 — periodically export ID-to-name tables so the collector can show interface names, SGT names, and app names instead of raw numbers.
flow exporter ... transport udp 6007 — an optional second collector that receives a copy of the same flows.
cache timeout active 10 — export long-lived flows every 10s even while still active.
cache timeout inactive 10 — age out and export a flow 10s after it goes idle.
cache timeout update 10 — for permanent/update caches, push periodic counter updates every 10s.
ip flow monitor NAME input|output attaches a monitor to an interface in one direction. Apply the IN record/monitor as input and the OUT record/monitor as output. See the duplicate-flow diagram above before applying both on the same traffic path.