Configure NetFlow in Cisco NCS 540 IOS-XR

Here's a link for the steps in configuring NetFlow (version 9) in a Cisco NCS 540 IOS-XR.

Step 1	Create and configure an exporter map.
Step 2	Create and configure a monitor map and a sampler map. Note  The monitor map must reference the exporter map you created in Step 1. If you do not apply an exporter-map to the monitor-map, the flow records are not exported, and aging is done according to the cache parameters specified in the monitor-map.
Step 3	Apply the monitor map and sampler map to an interface.

 

There are some caveats in configuring NetFlow in a Cisco IOS-XR:

• Do not use the management interface to export the NetFlow packets.
• NetFlow can be configured only in the ingress direction. 
  
• A source interface must always be configured. If you do not configure a source interface, the exporter will remain in a disabled state.
• Only export format Version 9 and IPFIX is supported.
• A valid record map name must always be configured for every flow monitor map.
• NetFlow is not supported on Bridge Virtual Interface (BVI).
• NetFlow is not supported on sub-interfaces.
• NetFlow on sub-interface routed via BVI is not supported.
• Destination-based Netflow accounting is not supported, only IPv4, IPv6 and MPLS record types are supported under monitor-map.
• Output interface field is not updated in data and flow records when the traffic is routed through ACL based forwarding (ABF).
• Output interface field is not updated in data and flow records for the multicast traffic.
• Output interface, source and destination prefix lengths fields are not set in data and flow records for GRE transit traffic.
• For Netflow IPFIX315, configure the hw-module profile netflow ipfix315 command.
• If IPFIX315 is enabled on a line card then all the ports on that line card should have IPFIX315 configured.
• For hw-module profile qos hqos-enable , NetFlow does not give the output interface for cases like L2 bridging, xconnect, IPFIX, and so on.
• L4 header port numbers are supported only for TCP and UDP.
• NetFlow does not give the output interface for traffic terminating on GRE tunnel.

  

Here's a sample NetFlow configuration template. It's similar to the legacy IOS IP accounting feature.

 

flow exporter-map <EXPORTER MAP NAME>
 destination <NETFLOW ANALYZER IP>
 transport udp 2055
 source <SOURCE INTERFACE>
version v9
  template data timeout 60
  template options timeout 60
  options interface-table
  options sampler-table

sampler-map <SAMPLER MAP NAME>
 random 1 out-of 500

flow monitor-map <MONITOR MAP NAME>
 record mpls ipv4-fields
 exporter <EXPORTER MAP NAME>
 cache entries 1000000
 cache timeout active 60
 cache timeout inactive 30
 cache timeout rate-limit 2000

commit

interface GigabitEthernet0/0/0/x
 flow mpls monitor <MONITOR MAP NAME> sampler <SAMPLER MAP NAME>

commit


show flow exporter <EXPORTER MAP NAME> location 0/0/CPU0

show flow monitor <MONITOR MAP NAME> cache format table location 0/0/CPU0

RP/0/RP0/CPU0:NCS540#show flow monitor MONITOR cache format table location 0/0/CPU0
Thu Dec 21 22:18:21.552 UTC
Cache summary for Flow Monitor MONITOR:
Cache size:                          65535
Current entries:                        13
Flows added:                            25
Flows not added:                         0
Ager Polls:                            573
  - Active timeout                      12
  - Inactive timeout                     0
  - Immediate                            0
  - TCP FIN flag                         0
  - Emergency aged                       0
  - Counter wrap aged                    0
  - Total                               12
Periodic export:
  - Counter wrap                         0
  - TCP FIN flag                         0
Flows exported                           0

LabelType Prefix/Length      Label1-EXP-S     Label2-EXP-S     Label3-EXP-S     Label4-EXP-S     Label5-EXP-S     Label6-EXP-S     InputInterface  OutputInterface ForwardStatus        FirstSwitched   LastSwitched    ByteCount    PacketCount  Dir SamplerID  IPV4SrcAddr      IPV4DstAddr      IPV4TOS  IPV4Prot L4SrcPort  L4DestPort L4TCPFlags   InputVRFID                        OutputVRFID                       BGPNextHopV4     
      LDP 10.14.6.35/32       24088-5-0        14724-5-1           -                -                -                -          Gi0/0/0/19      Gi0/0/0/1       Fwd                  08 16:44:31:287 08 16:45:20:486 2600         10           Ing 1          10.1.1.5         172.16.4.13   0xb8     udp      4790       4790       0            default                           default                           0.0.0.0          

<OUTPUT TRUNCATED>