Here are the structural components required to configure cflowd on a Cisco vSmart Controller. Each component is explained in more detail in the sections below.

policy
  lists
    prefix-list list-name
      ip-prefix prefix
    site-list list-name
      site-id site-id
    vpn-list list-name
      vpn vpn-id
  log-frequency number
  cflowd-template template-name
    collector vpn vpn-id address ip-address port port-number transport transport-type source-interface interface-name
    flow-active-timeout seconds
    flow-inactive-timeout seconds
    flow-sampling-interval number
    template-refresh seconds
  data-policy policy-name
    vpn-list list-name
      sequence number
        match
          match-parameters
        action
          cflowd
          count counter-name
          drop
          log
       default-action
         (accept | drop)
apply-policy site-list list-name
  data-policy policy-name
  cflowd-template template-name

Lists

Centralized data policy uses the following types of lists to group related items. You configure lists under the policy lists command hierarchy on Cisco vSmart Controllers.

Cflowd Templates

For each cflowd data policy, you must create a template that defines the location of the flow collector:

vSmart(config)# policy cflowd-template template-name

The template can specify cflowd parameters or it can be empty. With no parameters, the data flow cache on vEdge nodes is managed using default settings, and no flow export occurs.

In the cflowd template, you can define the location of the flow collection:

vSmart# (config-cflowd-template-template-name)
vSamrt# collector vpn vpn-id address 
ip-address port port-number 
transport transport-type source-interface 
interface-name

You can configure one cflowd template per Cisco vEdge device, and it can export to a maximum of four collectors.

You can configure flow export timers:

vSmart(config)# policy cflowd-template template-name
vSmart(config-cflowd-template-template-name)# flow-active-timeout seconds
vSmart(config-cflowd-template-template-name)# flow-inactive-timeout seconds
vSmart(config-cflowd-template-template-name)# template-refresh seconds

By default, an actively flowing data set is exported to the collector every 600 seconds (10 minutes), a data set for a flow on which no traffic is flowing is sent every 60 seconds (1 minute), and the cflowd template record fields are sent to the collector every 90 seconds. For flow sampling, by default, a new flow is started immediately after an existing flow ends.

For a single Cisco IOS XE SD-WAN device, you can configure a maximum of four collectors.

Data Policy Instance

For each centralized data policy, you create a named container for that policy with a policy data-policy policy-name command. For a single Cisco IOS XE SD-WAN device, you can configure a maximum of four cflowd policies.

VPN Lists

Each centralized data policy instance applies to the VPNs contained in a VPN list. Within the policy, you specify the VPN list with the policy data-policy vpn-list list-name command. The list name must be one that you created with a policy lists vpn-list​ list-name command.

Sequences

Within each VPN list, a centralized data policy contains sequences of match–action pairs. The sequences are numbered to set the order in which data traffic is analyzed by the match–action pairs in the policy. You configure sequences with the policy data-policy vpn-list sequence command.

Each sequence in a centralized data policy can contain one match command and one action command.

Match Parameters

Centralized data policy can match IP prefixes and fields in the IP headers. You configure the match parameters under the policy data-policy vpn-list sequence match command.

For data policy, you can match these parameters:

Action Parameters

When data traffic matches the conditions in the match portion of a centralized data policy, the packet can be accepted or rejected, and you can configure a counter for the accepted or rejected packets. You configure the action parameters under the policy data-policy vpn-list sequence action command.

For a packet that is accepted, configure the parameter cflowd to enable packet collection.

Default Action

If a data packet being evaluated does not match any of the match conditions in a control policy, a default action is applied to this route. By default, the route is rejected. To modify this behavior, include the policy data-policy vpn-list default-action accept command.

For a centralized data policy to take effect, you must apply it to a list of sites in the overlay network:

vSmart(config)# apply-policy site-list list-name data-policy policy-name

To activate the cflowd template, associate it with the data policy:

vSmart(config)# apply-policy cflowd-template template-name

For all data-policy policies that you apply with apply-policy commands, the site IDs across all the site lists must be unique. That is, the site lists must not contain overlapping site IDs. An example of overlapping site IDs are those in the two site lists site-list 1 site-id 1-100 and site-list 2 site-id 70-130. Here, sites 70 through 100 are in both lists. If you were to apply these two site lists to two different data-policy policies, the attempt to commit the configuration on the Cisco vSmart Controller would fail.

The same type of restriction also applies to the following types of policies:

• Application-aware routing policy (app-route-policy)

• Centralized control policy (control-policy)

• Centralized data policy (data-policy)

You can, however, have overlapping site IDs for site lists that you apply for different types of policy. For example, the sites lists for control-policy and data-policy policies can have overlapping site IDs. So for the two example site lists above, site-list 1 site-id 1-100 and site-list 2 site-id 70-130, you could apply one to a control policy and the other to a data policy.

As soon as you successfully activate the configuration by issuing a commit command, the Cisco vSmart Controller pushes the data policy to the Cisco IOS XE SD-WAN devices located in the specified sites. To view the policy as configured on the Cisco vSmart Controller, use the show running-config command on the Cisco vSmart Controller. To view the policy that has been pushed to the device, use the show policy from-vsmart command on the device.

To display the centralized data policy as configured on the Cisco vSmart Controller, use the show running-config command:

vSmart# show running-config policy 
vSmart# show running-config apply-policy

To display the centralized data policy that has been pushed to the Cisco IOS XE SD-WAN device, issue the show omp data-policy command on the device:

Device# show sdwan policy from-vsmart 

Enable Cflowd Visibility on Cisco IOS XE SD-WAN device Devices

You can enable cflowd visibility directly on Cisco IOS XE SD-WAN devices, without configuring a data policy, so that you can perform traffic flow monitoring on traffic coming to the router from all VPNs in the LAN. To do this, configure cflowd visiblity on the device:

Device(config)# policy flow-visibility 

To monitor the applications, use the show app cflowd flows and show app cflowd statistics commands on the device.

This topic shows a straightforward example of configuring traffic flow monitoring.

Configuration Steps

You enable cflowd traffic monitoring with a centralized data policy, so all configuration is done on a Cisco vSmart Controller. The following example procedure monitors all TCP traffic, sending it to a single collector:

1. Create a cflowd template to define the location of the collector and to modify cflowd timers:

   vsmart(config)# policy cflowd-template test-cflowd-template
   vsmart(config-cflowd-template-test-cflowd-template)# collector vpn 1 address 172.16.155.15 port 13322 transport transport_udp
   vsmart(config-cflowd-template-test-cflowd-template)# flow-inactive-timeout 60
   vsmart(config-cflowd-template-test-cflowd-template)# template-refresh 90

2. Create a list of VPNs whose traffic you want to monitor:

   
   vsmart(config)# policy lists vpn-list vpn_1 vpn 1

3. Create a list of sites to apply the data policy to:

   vsmart(config)# policy lists site-list cflowd-sites site-id 400,500,600

4. Configure the data policy itself:

   vsmart(config)# policy data-policy test-cflowd-policy
   vsmart(config-data-policy-test-cflowd-policy)# vpn-list vpn_1
   vsmart(config-vpn-list-vpn_1)# sequence 1
   vsmart(config-sequence-1)# match protocol 6
   vsmart(config-match)# exit
   vsmart(config-sequence-1)# action accept cflowd
   vsmart(config-action)# exit
   vsmart(config-sequence-1)# exit
   vsmart(config-vpn-list-vpn_1)# default-action accept

5. Apply the policy and the cflowd template to sites in the overlay network:

   vsmart(config)# apply-policy site-list cflowd-sites data-policy test-cflowd-policy
   ​Device(config-site-list-cflowd-sites)# cflowd-template test-cflowd-template

6. Activate the data policy:

   vsmart(config-site-list-cflowd-sites)# validate
   Validation complete
   vsmart(config-site-list-cflowd-sites)# commit
   Commit complete.
   vsmart(config-site-list-cflowd-sites)# exit configuration-mode

Full Example Configuration

Here is what the full example cflowd configuration looks like:

vsmart(config)# show configuration
apply-policy
 site-list cflowd-sites
  data-policy     test-cflowd-policy
  cflowd-template test-cflowd-template
 !
!
policy
 data-policy test-cflowd-policy
  vpn-list vpn_1
   sequence 1
    match
     protocol 6
    !
    action accept
     cflowd
    !
   !
   default-action accept
  !
 !
 cflowd-template test-cflowd-template
  flow-inactive-timeout 60
  template-refresh      90
  collector vpn 1 address 192.0.2.1 port 13322 transport transport_udp
 !
 lists
  vpn-list vpn_1
   vpn 1
  !
  site-list cflowd-sites
   site-id 400,500,600
  !
 !
!

Check the Cflowd Configuration

After you activate the cflowd configuration on the Cisco vSmart Controller, you can check it with the show running-config policy and show running-config apply-policy commands on the Cisco vSmart Controller. In addition, the configuration is immediately pushed down to the Cisco IOS XE SD-WAN devices at the affected sites.

You can view the pushed cflowd template with the show sdwan policy from-vsmart cflowd command. Here is the output from a device at site 500:

Device# show sdwan policy from-vsmart cflowd-template 
from-vsmart cflowd-template test-cflowd-template
 flow-active-timeout   30
 flow-inactive-timeout 60
 template-refresh      90
 collector vpn 1 address 192.0.2.1 port 13322 transport transport_udp

You can view all the pushed policy components with the show sdwan policy from-vsmart command:

Device# show sdwan policy from-vsmart 
from-vsmart data-policy test-cflowd-policy
 vpn-list vpn_1
  sequence 1
   match
    protocol 6
   action accept
    cflowd
  default-action accept
from-vsmart cflowd-template test-cflowd-template
 flow-active-timeout   30
 flow-inactive-timeout 60
 template-refresh      90
 collector vpn 1 address 192.0.2.1 port 13322 transport transport_udp
from-vsmart lists vpn-list vpn_1
 vpn 1

Check the Flows

On the Cisco IOS XE SD-WAN devices affected by the cflowd data policy, various commands let you check the status of the cflowd flows.

Device# show sdwan app-fwd cflowd statistics 

      data_packets             :      0 
      template_packets         :      0 
      total-packets            :      0 
      flow-refresh             :      123 
      flow-ageout              :      117 
      flow-end-detected        :      0 
      flow-end-forced          :      0