Catalyst 4500 Series Switch Software Configuration Guide, IOS XE 3.6.xE and IOS 15.2(2)Ex

Configuring Flexible NetFlow

---

Note Flexible NetFlow is supported only on Supervisor Engine 8-E, Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X.

Flow is defined as a unique set of key fields attributes, which might include fields of packet, packet routing attributes, and input and output interface information. A NetFlow feature defines a flow as a sequence of packets that have the same values for the feature key fields. Flexible NetFlow (FNF) allows you to collect and optionally export a flow record that specifies various flow attributes. NetFlow collection supports IP, IPv6 and Layer 2 traffic.

Note This chapter provides Catalyst 4500 switch specific information. For more information, refer to the URL:

http://www.cisco.com/en/US/products/ps6965/products_ios_protocol_option_home.html

Note When IP routing is disabled, on the interface configured with NetFlow Lite, packets are not received on NetFlow collector. Enable IP routing for the NetFlow collector to work.

This chapter addresses both VSS and non-VSS environments:

• VSS Environment
• Non-VSS Environment

VSS Environment

The following items apply to a Catalyst 4500 series switch w that belongs to a Virtual Switch System (VSS):

1. The Catalyst 4500 series switch supports ingress flow statistics collection for switched and routed packets; it does not support Flexible Netflow on egress traffic.

2. Each switch in an VSS has an independent NFE (Netflow Engine). This means that when there is ingress traffic on both the VSS Active and Standby switches, each is capable of creating flows for its ingress traffic

3. Configuration is performed on the VSS Active switch, which is synchronized to the VSS Standby switch.

4. Netflow show commands including Top Talkers, aggregate cache, and clear commands must be executed independently on VSS Active and Standby switch. The VSS Standby console will be available via remote console access from the VSS Active switch.

5. Supervisor Engine 8-E, Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X support a 100,000 entry hardware flow table. Both VSS Active and Standby switch have independent hardware flow tables of 100,000 entries. The hardware flow table is shared by all the flow monitors on a switch. To prevent one monitor from using all the flow table entries, the number of entries that it uses on a switch can be limited by the cache entries number command. This limit is per flow monitor, irrespective of the number of targets it is attached to.

The following example illustrates how to configure the flow monitor m1 cache to hold 1000 entries. With this configuration, interface gig 1/3/1 (on the VSS Active) can create a maximum of 1000 flows and interface gig 2/3/2 (on the VSS Standby) can create a maximum of 1000 flows:

6. Flow collection is supported on multiple targets (Port, VLAN, per-port per-VLAN (FNF can be enabled on a specific VLAN on a given port)) and on a port-channel (FNF is configured on the port-channel interface, rather than individual member ports). These targets can be on the VSS Active or on the VSS Standby. For example, if the target is a VLAN, it can consist of ports belonging to both switches. If there is ingress traffic in that VLAN on both switches, flows will be created in their independent flow caches. However, no Netflow configuration can be applied on the Virtual Switch Link (VSL) ports.

7. 64 unique flow record configurations are supported.

8. Flow QoS/UBRL and FNF cannot be configured on the same target. (For information on Flow-based QoS, see the section Flow-based QoS.)

9. 14,000 unique IPv6 addresses can be monitored.

10. On a given target, one monitor per traffic type is allowed. However, you can configure multiple monitors on the same target for different traffic types.

For example, the following configuration is allowed:

The following configuration is not allowed:

11. On a given target monitoring Layer 2 and Layer 3, simultaneous traffic is not supported:

!

12. Selection of Layer 2 and Layer 3 packet fields in a single flow record definition is not allowed. However, ingress 802.1Q VLAN Id of packet and Layer 3 packet field selection is allowed.

13. To attach a monitor to port or port-vlan targets, a flow record matching on ingress 802.1Q VLANId key field, must match on input interface also as key field.

Note The match datalink dot1q vlan input option is inavailable prior to IOS Release XE 3.3.0; you would only see the input option starting with the IOS Release XE 3.3.0.

14. Flow monitor matching on ingress 802.1Q VLANId as key field cannot be attached on a VNET trunk port target.

15. Only permanent and normal flow cache types are supported.

16. Supervisor Engine 8-E, Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X do not support:

– predefined records like traditional routers (record netflow ipv4 original-input)

– flow-based sampler.

17. On VLAN interfaces, when you use the interface option with the Cos, Tos, TTL or Packet length options, the system displays inaccurate results for the interface input field.

18. The VSS active and standby switches independently export flows, to the same or different Netflow collectors depending on flow exporter configuration. An IP route to the Netflow collector must exist and it is should be reachable from the VSS for flow export.

19. At the collector, the flow sequence numbers are local to a switch and will be monotonically increasing for each member of VSS. Additionally, the SourceId field of the v9 export packet uniquely identifies the VSS switch number that it was exported from.

20. The configuration of the flow exporter does not support the option output features.

21. Maximum number of VRFs that can be used for the flow exporter destination address configuration in VSS is 5. This limit includes the Global Routing Table and is common across all flow exporters in the VSS.

For example, when the user tries to configure an exporter destination address using a sixth VRF limit is exceeded, the following warning is displayed:

22. Flow aging in flow cache is controlled through active and in-active timer configuration. The minimum for active and in-active aging timers is 5 seconds. The timers must be in units of 5 seconds.

Note Flows in the hardware table are deleted after 5 seconds of in-activity irrespective of the active or in-active timer configuration values. This allows you to create new hardware flows quickly.

23. First and Last-seen flow timestamp accuracy is within 3 seconds.

24. 2048 Flow monitors and records are supported.

When TTL is configured as a flow field, the following values are reported for a given packet TTL value. Table 65-1 lists the packet TTL and reported values.

25. Cisco TrustSec (CTS) fields are supported. These fields use Netflow collector to monitor and troubleshoot the CTS network, and to segregate traffic based on source group tag (SGT) values.

– When configuring the source group tag ( collect flow cts source group-tag), note the following:

The system copies the packets to software before it retrieves the CTS field. A large number of flows mean that a large number of packets are copied to the software, possibly affecting CPU performance.

The maximum number of (unique) hosts allowed in the switch (IP addresses) is 12,000.

In case of burst packets, the software may not be able to retrieve the CTS field because the software queue is throttled.

– When configuring the destination group tag ( collect flow cts destination group-tag), note that this CTS field value is collected only if you have already configured an IP-to-SGT mapping.

– When configuring switch-derived source group tags ( collect flow cts switch derived-sgt), note that the switch derives this value locally.

• When packet length is configured as a flow field, the following values are reported for a given packet length value. Table 65-2 lists the packet length and reported values.

The following table lists the options available through FNF and the supported fields.

Non-VSS Environment

The following items apply to the Catalyst 4500 series switch:

The Catalyst 4500 series switch supports ingress flow statistics collection for switched and routed packets; it does not support Flexible Netflow on egress traffic.

1. Supervisor Engine 8-E, Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X support a 100,000 entry hardware flow table. The hardware flow table is shared by all the flow monitors on a switch. To prevent one monitor from using all the flow table entries, the number of entries that it uses on a switch can be limited by the cache entries number command. This limit is per flow monitor, irrespective of the number of targets it is attached to.

The following example illustrates how to configure the flow monitor m1 cache to hold 1000 entries. With this configuration, interface gig 3/1 can create a maximum of 1000 flows and interface gig 3/2 can create a maximum of 1000 flows:

2. Flow collection is supported on multiple targets (Port, VLAN, per-port per-VLAN (FNF can be enabled on a specific VLAN on a given port)) and on a port-channel (FNF is configured on the port-channel interface, rather than individual member ports).

3. 64 unique flow record configurations are supported.

4. Flow QoS/UBRL and FNF cannot be configured on the same target. (For information on Flow-based QoS, see the section Flow-based QoS.)

5. 14,000 unique IPv6 addresses can be monitored.

6. On a given target, one monitor per traffic type is allowed. However, you can configure multiple monitors on the same target for different traffic types.

For example, the following configuration is allowed:

The following configuration is not allowed:

7. On a given target monitoring Layer 2 and Layer 3, simultaneous traffic is not supported:

!

8. Selection of Layer 2 and Layer 3 packet fields in a single flow record definition is disallowed. However, ingress 802.1Q VLAN Id of packet and Layer 3 packet field selection is allowed.

9. To attach a monitor to port or port-vlan targets, a flow record matching on ingress 802.1Q VLAN Id as the key field, must also match on the input interface as the key field.

Note Flow monitor matching on ingress 802.1Q VLAN Id as the key field cannot be attached on a VNET trunk port target.

10. Only permanent and normal flow cache types are supported.

11. Supervisor Engine 8-E, Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X do not support:

– predefined records like traditional routers (record netflow ipv4 original-input)

– flow based sampler.

12. On VLAN interfaces, when you use the interface option with the Cos, Tos, TTL or Packet length options, the system displays inaccurate results for the interface input field.

13. The configuration of the flow exporter does not support the option output features.

14. Flow aging in flow cache is controlled through active and in-active timer configuration. The minimum for active and in-active aging timers is 5 seconds. The timers must be in units of 5 seconds.

Note Flows in the hardware table are deleted after 5 seconds of in-activity irrespective of the active or in-active timer configuration values. This allows you to create new hardware flows quickly.

15. First and Last-seen flow timestamp accuracy is within 3 seconds.

16. 2048 Flow monitors and records are supported.

When TTL is configured as a flow field, the following values are reported for a given packet TTL value. Table 65-4 lists the packet TTL and reported values.

17. Cisco TrustSec (CTS) fields are supported. These fields use Netflow collector to monitor and troubleshoot the CTS network, and to segregate traffic based on source group tag (SGT) values.

– When configuring the source group tag ( collect flow cts source group-tag), note the following:

The system copies the packets to software before it retrieves the CTS field. A large number of flows mean that a large number of packets are copied to the software, possibly affecting CPU performance.

The maximum number of (unique) hosts allowed in the switch (IP addresses) is 12,000.

In case of burst packets, the software may not be able to retrieve the CTS field because the software queue is throttled.

– When configuring the destination group tag ( collect flow cts destination group-tag), note that this CTS field value is collected only if you have already configured an IP-to-SGT mapping.

– When configuring switch-derived source group tags ( collect flow cts switch derived-sgt), note that the switch derives this value locally.

• When packet length is configured as a flow field, the following values are reported for a given packet length value. Table 65-5 lists the packet length and reported values.

The following table lists the options available through FNF and the supported fields.