A flow is exported as part of a NetFlow export User Datagram Protocol (UDP) datagram under these circumstances:

• The flow has been inactive or active for too long.

• The flow cache is getting full.

• One of the counters (packets and or bytes) has wrapped.

• The user forces the flow to export.

NetFlow export UDP datagrams are sent to an external flow collector device that provides NetFlow export data filtering and aggregation. The export of data consists of expired flows and control information.

The NetFlow infrastructure is based on the configuration and use of these maps:

• Exporter map

• Monitor map

• Sampler map

These maps are described in the sections that follow.

An exporter map contains user network specification and transport layer details for the NetFlow export packet. The flow exporter-map command allows you to configure collector and version attributes. You can configure these collector information:

• Export destination IP address

• DSCP value for export packet

• Source interface

• UDP port number (This is where the collector is listening for NetFlow packets.)

• Transport protocol for export packets

Note	In Cisco IOS XR Software, UDP is the only supported transport protocol for export packets.

Note	NetFlow export packets use the IP address that is assigned to the source interface. If the source interface does not have an IP address assigned to it, the exporter will be inactive.

You can also configure these export version attributes:

• Template timeout

• Template data timeout

• Template options timeout

• Interface table timeout

• Sampler table timeout

Note	A single flow monitor map can support up to eight exporters.

A monitor map contains name references to the flow record map and flow exporter map. Monitor maps are applied to an interface. You can configure these monitor map attributes:

• Number of entries in the flow cache

• Type of cache (permanent or normal). Permanent caches do not have their entries removed from the cache unless they are explicitly cleared by the user

• Active flow timeout

• Inactive flow timeout

• Update timeout

• Default timeouts

• Record type of packets sampled and collected

  Note	The record name specifies the type of packets that NetFlow samples as they pass through the router. Currently, MPLS, IPv4, and IPv6 packet sampling is supported.

Note	The active flow and inactive flow timeouts are associated with a normal cache type. The update timeout is associated with the permanent cache type.

The sampler map specifies the interval at which packets (one out of n packets) are sampled. On high bandwidth interfaces, applying NetFlow processing to every single packet can result in significant CPU utilization. Sampler map configuration is typically geared towards such high speed interfaces.

Consider these points before applying sampler map:

• You must remove the existing netflow configuration before applying a new sampler map on an already existing netflow interface configuration.

• Sub-interfaces and physical interfaces under a port must have the same sampler map configuration.

NetFlow version 9 is a template-based version. The templates provide an extensible design to the record format. This feature allows enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. An options template is a special type of template record that is used to communicate the format of data related to the NetFlow process. Rather than supplying information about IP flows, the options are used to supply metadata about the NetFlow process itself. The sampler options template and the interface options template are different forms of options templates. These two tables are exported by the NetFlow process. The NetFlow process will also export the VRF table.

Internet Protocol Flow Information Export (IPFIX) is an IETF standard export protocol for sending Netflow packets. IPFIX is based on Netflow version 9.

The IPFIX feature formats Netflow data and transfers the Netflow information from an exporter to a collector using UDP as transport protocol.

Consider SP-PE use case where SP (Service Provider) cloud is connected to the PE (Provider Edge) router through TenGigabit ethernet.

Configuring NetFlow on PE router involves:

1. Configuring Exporter map with IPFIX as an exporter

2. Configuring Monitor map

3. Configuring Sampler map

4. Applying the Monitor map and Sampler map to an interface

flow exporter-map fem_ipfix 
 destination 10.1.1.1
 source Loopback 0
 transport udp 1025
 exit
version ipfix
 template data timeout 600
 options sampler-table
exit

flow monitor-map fmm1
   record ipv4
    option filtered 
   exporter fem_ipfix
   cache entries 10000
   cache timeout active 1800
   cache timeout inactive 15
   exit 

sampler-map fsm1 
 random 1 out-of 4000  /*Sampling rate supported is 1:4000*/
exit

configure
 interface 10GE0/0/0/1
  flow ipv4 monitor fmm1 sampler fsm1 ingress 
 exit

RP/0/RP0/CPU0:router# show flow exporter-map fem_ipfix
Flow Exporter Map : fem_ipfix
-------------------------------------------------
Id                  : 3
Packet-Length       : 1468
DestinationIpAddr   : 10.1.1.1
VRFName             : default
SourceIfName        : Loopback1
SourceIpAddr        : 4.4.0.1
DSCP                : 40
TransportProtocol   : UDP
TransportDestPort   : 9001

Export Version: IPFIX
  Common Template Timeout : 1800 seconds
  Options Template Timeout : 1800 seconds
  Data Template Timeout : 1800 seconds
  Interface-Table Export Timeout : 0 seconds
  Sampler-Table Export Timeout : 0 seconds
  VRF-Table Export Timeout : 0 seconds

RP/0/RP0/CPU0:router(config)#flow exporter-map ipfix_exp1
RP/0/RP0/CPU0:router(config-fem)#version ipfix
RP/0/RP0/CPU0:router(config-fem-ver)#template options 
RP/0/RP0/CPU0:TU-PE3(config-fem-ver)#template options timeout
RP/0/RP0/CPU0:TU-PE3(config-fem-ver)#template options timeout 30
 
RP/0/RP0/CPU0:router# show flow exporter-map ipfix_exp1
version ipfix                                                                                                                                    
  template data timeout 30
!
dscp 40
transport udp 9001
source Loopback0
destination 10.127.59.86

In Cisco IOS XR Software, NetFlow map configuration takes place in map-specific submodes. Cisco IOS XR Software supports these NetFlow map configuration submodes:

Note	The Cisco IOS XR Software allows you to issue most commands available under submodes as one single command string from mode. For example, you can issue the record ipv4 command from the flow monitor map configuration submode as follows:

RP/0/RP0/CPU0:router(config)# flow monitor-map fmm
RP/0/RP0/CPU0:router(config-fmm)# record ipv4

Alternatively, you can issue the same command from global configuration mode, as shown in the following example:

RP/0/RP0/CPU0:router(config)# flow monitor-map fmm record ipv4

Cisco IOS XR Software supports the NetFlow collection of MPLS packets. It also supports the NetFlow collection of MPLS packets carrying IPv4, IPv6, or both IPv4 and IPv6 payloads.