NetFlow Configuration Example - Cisco 3850 IOS XE

10/13/2018 10:42 PM

4/21/2022 2:59 PM

This article contains a 2018 NetFlow configuration example to export flow data from Cisco 3850 IOS XE. some versions may need slight syntax changes.

Netflow Traffic Analyzer

The IOS XE requires separate flow records and flow monitors for ingress and egress.
 

flow record Netflow-In
match flow direction
match interface input
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match ipv4 tos
match transport destination-port
match transport source-port
collect counter bytes
collect counter packets
collect interface output

 

flow record Netflow-Out
match flow direction
match interface output
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match ipv4 tos
match transport destination-port
match transport source-port
collect counter bytes
collect counter packets
collect interface input

 

Flow Exporter
flow exporter Netflow-to-Orion
Source Loopback1 (Layer 3 Interface)
destination 10.10.10.10
transport udp 2055 (Orion’s collection port)
export-protocol netflow-v9

 

flow monitor Netflow-Monitor-In 
 exporter Netflow-to-Orion 
 cache timeout inactive 10 
 cache timeout active 60 
 record Netflow-In

 

flow monitor Netflow-Monitor-Out 
 exporter Netflow-to-Orion 
 cache timeout inactive 10 
 cache timeout active 60 
 record Netflow-Out

 

Config t# interface gigabitethernet 1/0/1
ip flow monitor Netflow-Monitor-In input
ip flow monitor Netflow-Monitor-Out output