Examples of Flexible NetFlow Configuration

11/29/2018 10:47 PM

1/21/2026 4:24 PM

This article provides example configurations for Cisco Flexible NetFlow that can be used as guidelines to help troubleshoot no NetFlow data being sent to the NetFlow collector on the SolarWinds server. 

Click How to configure NetFlow for Cisco routers and switches running IOS - video  to view a video on how to configure NetFlow for Cisco routers and switches running iOS.

Netflow Traffic Analyzer

These are examples for certain devices and there's a possibility that the IOS version might have changed, which means the commands are not available, or the configuration does not work. Please use these as guidelines to compare. If you have already checked with Wireshark that no NetFlow data is being received, contact the vendor to investigate.
 

Compare your switch configuration with the following configuration of Flexible NetFlow v5 on a 6509E device and consider adjusting your configuration accordingly:

!
flow record ORION-FLOW
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect interface output
collect counter bytes
collect counter packets
!
flow exporter ORION-EXPORTER
description NETFLOW Export to ORION
destination xxx.xxx.xxx.xxx
source Loopback0
transport udp 2055
export-protocol netflow-v5 (Cisco Has confirmed on certain devices NetFlow v5 is not supported and v9 should be used.)
!
flow monitor ORION-MONITOR
description ORION Netflow Monitor
record ORION-FLOW
exporter ORION-EXPORTER
!
interface vlan xxxx
ip flow monitor ORION-MONITOR input
!

 

This is another example that can be applied for inbound and outbound traffic. 

Flow record NETFLOW-RECORD-IN

match ipv4 tos

match ipv4 protocol

match ipv4 source address

match ipv4 destination address

match transport source-port

match transport destination-port

match interface input

collect interface output

collect counter bytes long

collect counter packets long

collect timestamp absolute first

collect timestamp absolute last


Flow record NETFLOW-RECORD-OUT

match ipv4 tos

match ipv4 protocol

match ipv4 source address

match ipv4 destination address

match transport source-port

match transport destination-port

match interface input

collect interface output

collect counter bytes long

collect counter packets long



Flow exporter NTAexport

Destination <SOLARWINDS IP ADDRESS>

Source <EX: VLAN, LOOPBACK, GIG-Interface> - Needs to have an IP Address since we listen by IP address with the collector on the Solarwinds server.

Transport udp 2055

Template data timeout 60



flow monitor NETFLOW-MON-IN

exporter NTAexport

cache timeout active 60

Record NETFLOW-RECORD-IN



flow monitor NETFLOW-MON-OUT

exporter NTAexport

cache timeout active 60

Record NETFLOW-RECORD-OUT

 

After the Netflow configuration is set up, you can assign the monitors to the interface you want to monitor Netflow on.

Example:

 

Switch# configure terminal

Switch (config) # wlan wlan1

Switch (config) # ip flow monitor NETFLOW-MON-IN input

Switch (config) # ip flow monitor NETFLOW-MON-OUT output

ASA FTD config

flow-export template timeout-rate 1