Configuring NetFlow on Cisco IOS XR Software

Consider a netflow configuration as shown below applied on Bundle interface.

RP/0/RP1/CPU0:router#show running-config interface bundle-ether 8888
Thu Oct 26 14:17:17.459 UTC
interface Bundle-Ether8888
ipv4 address 192.168.108.1 255.255.255.252
 ipv6 address 192:168:108::1/126
flow ipv6 monitor MONITOR-8k sampler SAMPLER-8k ingress
!
RP/0/RP1/CPU0:router#show running-config flow monitor-map MONITOR-8k
Thu Oct 26 14:17:32.581 UTC
flow monitor-map MONITOR-8k
 record ipv6
 exporter NF-2
 cache timeout update 30
!

The Netflow configuration includes:

• flow monitor map—MONITOR-8k: The flow monitor map do not have cache entries configured. Cache entries are the number of entries in the flow cache.

• exporter map—NF-2

• sampler map—SAMPLE-8k

The cache entries attribute is in-line modifiable. Let us configure the cache entries, while the flow monitor map is in use:

RP/0/RP1/CPU0:router#config
RP/0/RP1/CPU0:router(config)#flow monitor-map MONITOR-8k
RP/0/RP1/CPU0:router(config-fmm)#cache entries 8000
RP/0/RP1/CPU0:router(config-fmm)#commit
Thu Oct 26 14:18:24.625 UTC
RP/0/RP1/CPU0:Oct 26 14:18:24.879 : config[67366]: %MGBL-CONFIG-6-DB_COMMIT : Configuration committed by user '<username>'. 
Use 'show configuration commit changes 1000000556' to view the changes.  /*configuration commit is successfull. */

The above configuration changes are committed successfully.

RP/0/RSP0/CPU0:router# show flow monitor-map MONITOR-8k

Flow Monitor Map : MONITOR-8k
-------------------------------------------------
Id:                1
RecordMapName:     ipv6
ExportMapName:     NF-2
CacheAgingMode:    Permanent
CacheMaxEntries:   8000
CacheActiveTout:   N/A
CacheInactiveTout: N/A
CacheUpdateTout:   30 seconds

Here are few key points to consider before implementing IPFIX 315:

• Supported only in ingress direction.

• Supported on main interface only. The traffic on all sub-interfaces under the main interface is exported.

• Sampling rate for bundles is per member-link and not per bundle interface.

• The outgoing interface information may not be correct incase of packets that are multicasted or broadcasted on multiple ports.

• The incoming and outgoing interface will have information of main interface and not the sub-interface even if the packet is routed via sub-interface. Incase of bundles it will point to bundle main interface.

• IPFIX 315 is not supported on BVI interface.

• Sampling and exporting of the control packets is not supported.

• When you configure ipfix315-enable, then you must configure all the ports on that LC with datalinkframesection flow.

• When the HQoS profile is enabled, Netflow does not give correct Output Interface. DSP is unique for each sub-interface.

• Netflow on the L2 interface assumes IPv4/IPv6/MPLS traffic, and if the traffic is purely L2 based, then the system ignores that traffic.

• You must remove all v9 configurations before reloading an LC. Else, with the existing v9 configurations on LC reload, you might encounter a few configuration apply error. Or, flow might be seen on an interface even when apply on interface has failed.

Configuring IPFIX 315 involves:

1. Configuring Exporter map

2. Configuring Monitor map

3. Configuring Sampler map

4. Enabling IPFIX 315 on a line card

5. Applying the Monitor map and Sampler map to an interface

flow exporter-map ipfix_exp
 version ipfix
 !
 dscp 40
 transport udp 9001
 source Loopback1
 destination 100.10.1.159
!

flow monitor-map ipfix_mon
 record datalinksectiondump
 exporter ipfix_exp
 cache immediate
 cache entries 1000000
 cache timeout rate-limit 1000000
!

Configuring Sampler map

sampler-map ipfix_sm
 random 1 out-of 32000
!

Note	The default cache size is 65535, hence you can configure sampling rate as 1 out of 65535 packets. However the recommended sampling rate is 1 out of 32000 packets.

(config)# hw-module profile netflow ipfix315-enable location 0/0/CPU0 

interface HundredGigE 0/0/0/18
        flow datalinkframesection monitor ipfix_mon sampler ipfix_sm ingress

RP/0/RP0/CPU0#show flow platform producer statistics location 0/0/CPU0 
Netflow Platform Producer Counters:
IPv4 Ingress Packets:                        0
IPv4 Egress Packets:                         0
IPv6 Ingress Packets:                        0
IPv6 Egress Packets:                         0
MPLS Ingress Packets:                        0
MPLS Egress Packets:                         0
IPFIX315 Ingress Packets:               630478
IPFIX315 Egress Packets:                     0
Drops (no space):                            0
Drops (other):                               0
Unknown Ingress Packets:                     0
Unknown Egress Packets:                      0
Worker waiting:                           2443

RP/0/RP0/CPU0#show flow monitor ipfix_mon cache location 0/0/CPU0

Cache summary for Flow Monitor ipfix_mon:
Cache size:                          65535
Current entries:                         0
Flows added:                         50399
Flows not added:                         0
Ager Polls:                           2784
  - Active timeout                       0
  - Inactive timeout                     0
  - Immediate                        50399 /*cache type immediate*/
  - TCP FIN flag                         0
  - Emergency aged                       0
  - Counter wrap aged                    0
  - Total                            50399
Periodic export:
  - Counter wrap                         0
  - TCP FIN flag                         0
Flows exported                       50399


Matching entries:                        0

When you issue the flow monitor-map map_name command in mode, the CLI prompt changes to “config-fmm,” indicating that you have entered the flow monitor map configuration submode.

In this sample output, the question mark (?) online help function displays all the commands available under the flow monitor map configuration submode:

RP/0/RP0/CPU0:router(config)# flow monitor-map fmm

RP/0/RP0/CPU0:router(config-fmm)# ?

cache     Specify flow cache attributes
commit    Commit the configuration changes to running
describe  Describe a command without taking real actions
do        Run an exec command
exit      Exit from this submode
exporter  Specify flow exporter map name
no        Negate a command or set its defaults
record    Specify a flow record map name
show      Show contents of configuration

When you issue the version v9 command in the flow exporter map configuration submode, the CLI prompt changes to “config-fem-ver,” indicating that you have entered the flow exporter map version configuration submode.

In this sample output, the question mark (?) online help function displays all the commands available under the flow exporter map version configuration submode:

RP/0/RP0/CPU0:router(config-fem)# version v9

RP/0/RP0/CPU0:router(config-fem-ver)# ?

commit    Commit the configuration changes to running
describe  Describe a command without taking real actions
do        Run an exec command
exit      Exit from this submode
no        Negate a command or set its defaults
options   Specify export of options template
show      Show contents of configuration
template  Specify template export parameters

When you issue the flow monitor-map map_name command in mode, the CLI prompt changes to “config-fmm,” indicating that you have entered the flow monitor map configuration submode.

In this sample output, the question mark (?) online help function displays all the commands available under the flow monitor map configuration submode:

RP/0/RP0/CPU0:router(config)# flow monitor-map fmm

RP/0/RP0/CPU0:router(config-fmm)# ?

cache     Specify flow cache attributes
commit    Commit the configuration changes to running
describe  Describe a command without taking real actions
do        Run an exec command
exit      Exit from this submode
exporter  Specify flow exporter map name
no        Negate a command or set its defaults
record    Specify a flow record map name
show      Show contents of configuration

When you issue the sampler-map map_name command in mode, the CLI prompt changes to “config-sm,” indicating that you have entered the sampler map configuration submode.

In this sample output, the question mark (?) online help function displays all the commands available under the sampler map configuration submode:

RP/0/RP0/CPU0:router(config)# sampler-map fmm

RP/0/RP0/CPU0:router(config-sm)# ?
clear     Clear the uncommitted configuration
clear     Clear the configuration
commit    Commit the configuration changes to running
describe  Describe a command without taking real actions
do        Run an exec command
exit      Exit from this submode
no        Negate a command or set its defaults
pwd       Commands used to reach current submode
random    Use random mode for sampling packets
root      Exit to the global configuration mode
show      Show contents of configuration

Use the bgp attribute-download command to enable NetFlow BGP routing attribute collection. The routing attributes are then exported. When no routing attributes are collected, zeroes (0) are exported.

When BGP attribute download is enabled, BGP downloads the attribute information for prefixes (community, extended community, and as-path) to the Routing Information Base (RIB) and Forwarding Information Base (FIB). This enables FIB to associate the prefixes with attributes and send the NetFlow statistics along with the associated attributes.

In Cisco IOS XR Software, at a time, you can have only one MPLS flow monitor running on an interface. If you apply an additional MPLS flow monitor to the interface, the new flow monitor overwrites the existing one.

You can configure the MPLS flow monitor to collect IPv4 fields, IPv6 fields, or IPv4-IPv6 fields. IPv4-IPv6 configuration collects both IPv4 and IPv6 addresses using one MPLS flow monitor. IPv4 configuration collects only IPv4 addresses. IPv6 configuration collects only IPv6 addresses.

The MPLS flow monitor supports up to 1,000,000 cache entries. NetFlow entries include these types of fields:

• IPv4 fields

• IPv6 fields

• MPLS with IPv4 fields

• MPLS with IPv6 fields

The maximum number of bytes per NetFlow cache entry is as follows:

• IPv4–88 bytes per entry

• IPv6–108 bytes per entry

• MPLS with IPv4 fields–108 bytes per entry

• MPLS with IPv6 fields–128 bytes per entry

Note

The different types of NetFlow entries are stored in separate caches. Consequently, the number of NetFlow entries on a line card can significantly impact the amount of available memory on the line card. Also, even though the sampling rate for IPv6 is the same as the sampling rate for IPv4, the CPU utilization for IPv6 is higher due to the longer keys used by the IPv6 fields.

The collection of IPv6 flows in MPLS packets is an option. The CPU uses 128 bytes for each IPv6 field. IPv6 flows may contain these types of information:

• Source IP address

• Destination IP address

• Traffic class value

• Layer 4 protocol number

• Layer 4 source port number

• Layer 4 destination port number

• Flow ID

• Header option mask

To collect the IPv6 fields in MPLS packets, you must activate the MPLS record type, ipv6-fields by running the record mpls ipv6-fields command. You can also specify the number of labels to be used for aggregation with this command.