A flow is exported as part of a NetFlow export User Datagram Protocol (UDP) datagram under these circumstances:

• The flow has been inactive or active for too long.

• The flow cache is getting full.

• One of the counters (packets and or bytes) has wrapped.

• The user forces the flow to export.

NetFlow export UDP datagrams are sent to an external flow collector device that provides NetFlow export data filtering and aggregation. The export of data consists of expired flows and control information.

The NetFlow infrastructure is based on the configuration and use of these maps:

• Exporter map

• Monitor map

• Sampler map

These maps are described in the sections that follow.

An exporter map contains user network specification and transport layer details for the NetFlow export packet. The flow exporter-map command allows you to configure collector and version attributes. You can configure these collector information:

• Export destination IP address

• DSCP value for export packet

• Source interface

• UDP port number (This is where the collector is listening for NetFlow packets.)

• Transport protocol for export packets

Note	In Cisco IOS XR Software, UDP is the only supported transport protocol for export packets.

Note	NetFlow export packets use the IP address that is assigned to the source interface. If the source interface does not have an IP address assigned to it, the exporter will be inactive.

You can also configure these export version attributes:

• Template timeout

• Template data timeout

• Template options timeout

• Interface table timeout

• Sampler table timeout

Note	A single flow monitor map can support up to eight exporters.

A monitor map contains name references to the flow record map and flow exporter map. Monitor maps are applied to an interface. You can configure these monitor map attributes:

• Number of entries in the flow cache

• Type of cache (permanent or normal); permanent caches entries aren’t removed from the cache unless they are explicitly cleared by the user.

• Active flow timeout

• Inactive flow timeout

• Update timeout

• Default timeouts

• Record type of packets sampled and collected

  Note	The record name specifies the type of packets that NetFlow samples as they pass through the router. Currently, MPLS, IPv4, MAP-T and IPv6 packet sampling are supported.

Note	The active flow and inactive flow timeouts are associated with a normal cache type. The update timeout is associated with the permanent cache type.

The sampler map specifies the rate at which packets (one out of n packets) are sampled. The sampler map configuration is typically geared for high-speed interfaces to optimize CPU utilization. To achieve this, start by setting the sampling rate after evaluating your network parameters such as traffic rate, number of total flows, cache size, active and inactive timers.

Sampling rate per interface = (Average number of packet per NP / Policer rate per NP) * (Total number of directions with NetFlow configuration)

• The maximum supported sampling rate is 1:1, where every packet is processed.

• The minimum supported sampling rate is 1:65,535, indicating that only one out of every 65,535 packets is processed.

• Typical sampling rates are 1:8,000 or 1:16,000. The ideal sampling rate depends on the packets per second on sampling-enabled interfaces, total packet flows, and the rate of flows you want to monitor.

Consider these points before applying sampler map:

• Remove the existing Netflow configurations before applying a new sampler map on an already existing netflow interface configuration.

• Sub-interfaces and physical interfaces under a port must have the same sampler map configuration.

Note	To check the NetFlow policer rate programmed on an NP use the, show flow platform nfea policer npnp-number location node-id command. To find the NP number of the NetFlow interface, use the show controllers np ports all command.

The Policer rate is based on the network processor (NP). If netflow is applied on 1 NP, the aggregated maximum flow packet processing rate per line card (LC) is 100k flow packets per second for the ASR 9000 Ethernet LC and 200k flow packets per second for the ASR 9000 Enhanced Ethernet LC (irrespective of the direction and the number of interface netflow that is applied in that NP). However, depending on the Netflow monitor configuration distribution among NPs in an LC, policing of flow packet can take effect with an aggregated rate that is less than the aggregated maximum flow packet processing rate. For example for the ASR 9000 Ethernet LC, if Netflow is applied to 1 interface per NP in a 4 NP LC, then the Policer rate per NP is 25K packets per second.

Note	On Cisco ASR 9000 High Density 100GE Ethernet line cards, when the configured sampling rate is one of the following values, the sampling behavior is random with a deviation of more than 10 percent: 2048 4096 8192 16384 32768 65535

The In-line modification of Netflow configuration enables to add or remove flow attributes of a flow entity that is already applied to an interface.

A flow entity can be a monitor map, exporter map or a sampler map.

Netflow does not support in-line modification of all its configuration items. This table lists flow entries and flow attributes that are in-line modifiable.

Note	In-line modification of flow items clears the cache counters. As a result there could be flow accounting mismatch.

Note	The In-line modification of Netflow configuration is supported on Cisco IOS XR 64 bit software.

NetFlow version 9 is a template-based version. The templates provide an extensible design to the record format. This feature allows enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. An options template is a special type of template record that is used to communicate the format of data related to the NetFlow process. Rather than supplying information about IP flows, the options are used to supply metadata about the NetFlow process itself. The sampler options template and the interface options template are different forms of options templates. These two tables are exported by the NetFlow process. From release 5.2.0, the NetFlow process will also export the VRF table.

In Cisco IOS XR Software, NetFlow map configuration takes place in map-specific submodes. Cisco IOS XR Software supports these NetFlow map configuration submodes:

Note	The Cisco IOS XR Software allows you to issue most commands available under submodes as one single command string from global configuration mode. For example, you can issue the record ipv4 command from the flow monitor map configuration submode as follows:

RP/0/RSP0/CPU0:router(config)# flow monitor-map fmm
RP/0/RSP0/CPU0:router(config-fmm)# record ipv4

Alternatively, you can issue the same command from global configuration mode, as shown in the following example:

RP/0/RSP0/CPU0:router(config)# flow monitor-map fmm record ipv4

Cisco IOS XR Software supports the NetFlow collection of MPLS packets. It also supports the NetFlow collection of MPLS packets carrying IPv4, IPv6, or both IPv4 and IPv6 payloads.

Destination-based NetFlow accounting (DBA) is a usage-based billing application that tracks and records traffic according to its destination. It enables service providers to do destination-specific accounting and billing. The destination-based NetFlow accounting record includes the destination peer autonomous system (AS) number and the BGP next-hop IP address.

Note	When an EBGP neighborship is established towards a directly connected peer (neighborship toward's the Peer routers Global IPv6 address configured on the directly connected interface), the EBGPv6 peer will advertise both the Link Local Next Hop (LL NH) and the Global Next Hop.

IPv4 DBA is already supported in CRS. In Release 4.3.1, the support for IPv6 DBA support is added.

DBA is supported on ASR9000 Gigabit Ethernet and ASR9000 Enhanced Gigabit Ethernet linecards.

In destination-based NetFlow accounting, these parameters are collected and exported to destination:

• Destination peer AS number

• BGP next-hop IP address

• Ingress interface

• Egress interface

• Forwarding status

• Incoming IPv4 TOS

• Counter of packets in the flow

• Counter of bytes in the flow

• Timestamp for the first and last packets in the flow

• Counter of packets in the flow (64 bits)

• Counter of bytes in the flow (64 bits)

• Timestamp for the first and last packet in the flow. This is the timestamp when the flow is reported from hardware to the NetFlow server. 

Destination-based NetFlow accounting supports:

• IPv4 and IPv6 addresses

• Configuration on physical interfaces, bundle interfaces, and logical subinterfaces

• IPv4 unicast and multicast traffic

• IPv6 unicast and multicast traffic

• Only ingress traffic

• Only full mode NetFlow

• NetFlow export format Version 9 over User Datagram Protocols (UDPs)

• All line cards (LCs)

• Normal cache type (active and inactive timeout aged flow records)

• Permanent cache type (no aging for flow records)

Destination-based NetFlow accounting does not support:

• MPLS IPv4 and IPv6

• Configuration for individual Modular QoS Command-Line Interface (MQC) classes

• Simultaneous configuration of destination-based NetFlow accounting with IPv4 and IPv6 sampled NetFlow on the same interface, in the same direction.

• Layer 2 switched MPLS traffic

• Egress traffic

• Sampled mode NetFlow

• NetFlow export formats version 5, version 8, IP Flow Information Export (IPFIX), or Stream Control Transmission Protocol (SCTP).

• Immediate cache type

This enhancement enables Netflow records to download recursive IPv6 global next-hops instead of IPv6 link-local next-hops for directly connected eBGP IPv6 neighbors. Downloading the IPv6 global next-hops helps Netflow records to capture BGP attributes (source AS and BGP IPv6 nexthop).

To enable this feature, use the set next-hop ipv6-global command in route-policy configuration mode.

RP/0/RSP0/CPU0:router(config)# route-policy sample-table
RP/0/RSP0/CPU0:router(config-rpl)# set next-hop ipv6-global
RP/0/RSP0/CPU0:router(config-rpl)# end-policy

RP/0/RSP0/CPU0:router(config)# router bgp 100
RP/0/RSP0/CPU0:router(config-bgp)# address-family ipv6 unicast
RP/0/RSP0/CPU0:router(config-bgp-af)# table-policy sample-table
RP/0/RSP0/CPU0:router(config-bgp-af)# commit
  
	

These are the restrictions for the flow filter feature:

• Supported on physical interface, physical subinterface, bundle interface, and bundle subinterface

• Not supported on satellite access interface, ICL interface and clusters.

• MPLS netflow filtering is not supported.

Consider SP-PE use case where SP (Service Provide) cloud is connected to the PE (Provider Edge) router through gigabit ethernet.

Configuring NetFlow on PE router involves:

1. Configuring ACL based filter criteria for NetFlow

2. Configuring Monitor map with filter netflow object

3. Configuring Sampler map

4. Configuring Exporter map

5. Applying the NetFlow flow filter ACL configuration and Monitor map to an interface

ipv4 access-list nf_ex
   10 permit ipv4 192.168.1.1/24 any capture
   

flow monitor-map fmm1
   record ipv4
    option filtered 
   exporter fem1
   cache entries 10000
   cache timeout active 1800
   cache timeout inactive 15
   exit 

sampler-map fsm1 
 random 1 out-of 65535
exit

flow exporter-map fem1 
 destination 10.1.1.1
 source Loopback 0
 transport udp 1024
 dscp 10
exit
version v9
 template data timeout 600
 options interface-table
exit

interface 10GE0/0/0/1
ipv4 access-group nf_ex_ing
flow ipv4 monitor fmm1 sampler fsm1 ingress 
exit

RP/0/RSP0/CPU0:router# show flow monitor fmm1 location 0/0/CPU0

Flow Monitor :        fmm1                        
---------------------------------------------
  Flow definition:    ipv4-raw                        
  Cache configuration:
    Type:             Normal                          
    Cache size:                      65535 entries
    Inactive timeout:                   15 seconds
    Active timeout:                   1800 seconds
    Update timeout:                    N/A
    Rate limit:                       2000 entries per second
    Options:                      filtered