Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Example NetFlow Config - Cisco ASR

Example NetFlow Config - Cisco ASR

Table of contents
Created by Justin Wyllys, last modified by MindTouch on Jun 23, 2016

Views: 459 Votes: 0 Revisions: 3


This is an example Cisco ASR configuration for enabling flow export. As your equipment or software versions may vary, we recommend consulting Cisco's knowledge base if you need more information or assistance configuring your device. 


All NTA versions



The NetFlow infrastructure is based on the configuration and use of the following maps:
• Exporter Map
• Sampler Map
• Flow Monitor Map


Exporter Map:
To configure the Exporter map, you need to define the destination (flow collector), the source interface, the port used for exporting, the version of NetFlow, and the timeout rates.

router(config)# flow exporter-map ORION-EM
router(config-fem)# destination
router(config-fem)# source gi0/0
router(config-fem)# transport udp 2055
router(config-fem)# version v9
 router(config-fem)# template data timeout 60
router(config-fem)# options interface-table timeout 60
 router(config-fem)# exit


Sampler Map:
The Sampler map defines the sample rate, default for the ASR series is 10000, no default for the XR 12000, but recommended sample value is 10000 for optimal performance.

router(config)# sampler-map ORION-SM
 router(config-sm)# random 1 out-of 10000
 router(config)# exit


Flow Monitor Map:
The Flow Monitor map defines the cache timeout values and associates the exporter map with this map.

router(config)# flow monitor-map ORION-FMM
 router(config-fmm)# record ipv4
 router(config-fmm)# exporter ORION-EM
router(config-fmm)# cache timeout active 60
router(config-fmm)# cache timeout inactive 15
 router(config-fmm)# exit
Apply the maps to the interfaces
Now that you have your maps defined, you need to apply the Flow Monitor and Sampler maps to each of your active interfaces:

router(config)# interface Gi0/0
router(config-if)# flow ipv4 monitor ORION-FMM sampler ORION-SM ingress
router(config-if)# exit


More info:

NetFlow Commands on Cisco ASR 9000 Series Router 

NetFlow Commands on Cisco IOS XR Software



Last modified
20:32, 22 Jun 2016