Flexible NetFlow is an advancement on the original NetFlow that adds the capability to customize the traffic analysis parameters for your specific requirements. Flexible NetFlow facilitates the creation of more complex configurations for traffic analysis and data export through the use of reusable configuration components.

The Security Unified Logging (SUL) profile acts as a superset containing all the information present in an application-level and a flow-level profile.

If you do not require detailed flow-level statistics, you can use Application Visibility for your FNF monitors. Alternatively, you can enable the flow-level FNF monitor to view all the data that is captured including application-level statistics.

By enabling flow-level visibility monitor on either the LAN interface or WAN interface, you can avoid double packet counts. This prevents data redundancy which is caused by ingress and egress data traffic flow from LAN to WAN.

The IPv4 and the IPv6 protocols are enabled by default after the performance monitor context is attached to an interface. But, you can choose to enable either IPv4 or IPv6 protocols by configuring the performance monitoring context.

SD-Routing supports three types of FNF monitoring methods:

• Aggregated NetFlow Application Visibility

• Flow-level FNF

• Security Unified Logging (SUL)

Following are the benefits if you enable Flow-level FNF:

• Flow-level FNF provides statistics at a granular level.

• Flow-level FNF statistics are used in Cisco Catalyst SD-WAN Analytics and SD-WAN monitoring for On-demand troubleshooting.

Flexible NetFlow consists of components that can be used together in several variations to perform data export and traffic analysis. The user-defined flow records and the component structure of Flexible NetFlow facilitates the creation of various configurations for exporting the data and analysing traffic on a networking device with a minimum number of configuration commands.

Each flow monitor can have a unique combination of flow record, flow exporter, and cache type. If you change a parameter such as the destination IP address for a flow exporter, it is automatically changed for all the flow monitors that use the flow exporter. The following sections provide more information on Flexible NetFlow components:

• Flow Records

  In Flexible NetFlow a combination of key and nonkey fields is called a record. Flexible NetFlow records are assigned to Flexible NetFlow flow monitors to define the cache that is used for storing flow data.

• Flow Exporters

  Flow exporters export the data in the flow monitor cache to a remote system, such as a server running NetFlow collector, for analysis and storage. Flow exporters are created as separate entities in the configuration. Flow exporters are assigned to flow monitors to provide data export capability for the flow monitors. You can create several flow exporters and assign them to one or more flow monitors to provide several export destinations. You can create one flow exporter and apply it to several flow monitors.

• Flow Monitors

  Flow monitors are the Flexible NetFlow components which are applied to interfaces to perform network traffic monitoring.

  Flow monitors consist of a user-defined record, an optional flow exporter, and a cache that is automatically created at the time the flow monitor is applied to the first interface.

  Flow data is collected from the network traffic and added to the flow monitor cache during the monitoring process based on the key and nonkey fields in the flow record.

There are two ways to enable Flow-level FNF:

• Using an EzPM Profile: This is a simple recommended way where you can use the existing profiles to configure flow records. By using EzPM profile, you can configure Application-visibility, Flow-level visibility, and SUL monitors.

• Using a Flow Monitor: This is a manual process where flow records are created and exported to a Local Exporter for Application-visibility, Flow-level visibility, and SUL.

You need to enable license boot-level advantage on the Cisco router. This gives you the network advantage to use EzPM profile CLI support.

Following are the limitations on configuring flow-level FNF:

• Flow-level configuration for SD-Routing devices is possible on the Cisco SD-WAN Manager through CLI based configuration groups, CLI templates, or CLI Add-on profiles.

• Application-level and Flow-level visibility monitors both ingress and egress data on the target interface. If configured on both service and transport interface, the packet for the same flow is counted twice.

• Customizing flow monitors with partial flow-level record fields is not allowed. If partial flow-level record fields are added to monitors, PSV data is not generated.

• You can configure either application-visibility, flow-level, or the SUL profile on one interface. You can attach only one type of EzPM profile to an interface.

Security Unified Logging allows you to have visibility into the log data for Zone-based Firewall and for Unified Threat Defense features such as IPS, URL-F and AMP. These features help you to understand what traffic, threats, sites or malware were blocked, and the rules that blocked the traffic or sessions with the associated port, protocol, or applications.

SUL profiles have all the flow-level fields in it, so you do not need to attach flow-level visibility to an interface if the SUL profile is already attached to it. SUL supports both IPv4 and IPv6 protocols.

Following are the limitations to configure SUL on a device:

• The SUL profile should not be configured if other FNF profiles are configured, such as application-visibility (aggregate FNF) or flow-visibility. These three profiles should be mutually exclusive to avoid data redundancy.

• Customizing flow monitors with partial SUL record fields is not allowed. If partial SUL record fields are added to monitors, PSV data is not generated.

• Due to a design limitation, by default, SUL needs to be applied to both LAN and WAN interface since SUL monitor only collects the output direction.

To enable flow-level FNF using Cisco SD-WAN manager, begin with creating a configuration group followed by the steps provided below.