Enabling and Monitoring NetFlow on Subinterfaces

Transcription

1 Enabling and Monitoring NetFlow on Subinterfaces This module contains instructions for enabling and monitoring NetFlow on a router subinterface or a Versatile Interface Processor (VIP) controller interface. NetFlow is a Cisco IOS application that provides statistics on packets flowing through the router. It is emerging as a primary network accounting technology. Module History This module was first published on May 2, 2005, and last updated on May 2, Finding Feature Information in This Module Your Cisco IOS software release may not support all features. To find information about feature support and configuration, use the Feature Information for Enabling and Monitoring NetFlow on Subinterfaces section on page 14. Contents Prerequisites for Enabling and Monitoring NetFlow on Subinterfaces, page 2 Information About Enabling and Monitoring NetFlow on Subinterfaces, page 2 How to Enable and Monitor NetFlow on Subinterfaces, page 3 Configuration Examples for Enabling and Monitoring NetFlow on Subinterfaces, page 11 Additional References, page 11 Glossary, page 13 Feature Information for Enabling and Monitoring NetFlow on Subinterfaces, page 14 Corporate Headquarters: Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA USA Copyright 2005 Cisco Systems, Inc. All rights reserved.

2 Prerequisites for Enabling and Monitoring NetFlow on Subinterfaces Enabling and Monitoring NetFlow on Subinterfaces Prerequisites for Enabling and Monitoring NetFlow on Subinterfaces Prerequisites for the NetFlow Subinterface Support We recommend that you configure NetFlow on the main interface, if you are already collecting data from the majority of its subinterfaces. If NetFlow is not configured on the main interface, NetFlow performs additional checks for the status of each subinterface that requires more CPU processing time and bandwidth. To enable NetFlow on the main interface, see the Configuring NetFlow to Capture and Export Network Traffic Data module. Prerequisites for Configuring NetFlow on a Distributed VIP Interface The router must be configured for IP routing. If you are configuring NetFlow on a Cisco 7500 series router with a Route Switch Processor (RSP) and with VIP controllers, see the Configuring NetFlow on a Distributed VIP Interface section on page 9. Information About Enabling and Monitoring NetFlow on Subinterfaces Before enabling NetFlow on a Subinterface or VIP interface, you should understand the following: NetFlow Subinterface Configuration Benefits: Fine-Tuning Your Data Collection, page 2 Effect of the ip route-cache flow Command on NetFlow Subinterface Configuration, page 2 NetFlow Support on Cisco 7500 VIP Controllers, page 9 NetFlow Subinterface Configuration Benefits: Fine-Tuning Your Data Collection You can configure NetFlow on a per-subinterface basis. If your network contains thousands of subinterfaces and you want to collect export records from only a few subinterfaces, you can do that. The result is lower bandwidth requirements for NetFlow data export and reduced platform requirements for NetFlow data-collection devices. The configuration of NetFlow on selected subinterfaces provides the following benefits: Reduced bandwidth requirement between routing devices and NetFlow management workstations. Reduced NetFlow workstation requirements; the number of flows sent to the workstation for processing is reduced. 2

3 Enabling and Monitoring NetFlow on Subinterfaces How to Enable and Monitor NetFlow on Subinterfaces Effect of the ip route-cache flow Command on NetFlow Subinterface Configuration You can configure NetFlow on selected subinterfaces through the ip flow ingress command. If you configure the ip flow ingress command on a few selected subinterfaces and then configure the ip route-cache flow command on the main interface, enabling the main interface overwrites the ip flow ingress command, and data collection starts from the main interface as well as on all the subinterfaces. If you configure the ip flow ingress command and then configure the ip route-cache flow command on the main interface, you can restore subinterface data collection by using the no ip route-cache flow command. This configuration disables data collection from the main interface and restores data collection to the subinterfaces that you originally configured with the ip flow ingress command. How to Enable and Monitor NetFlow on Subinterfaces Perform the following tasks to enable and monitor NetFlow on a subinterface or VIP interface: Enabling NetFlow on a Subinterface, page 3 (required) Managing the Display of NetFlow Statistics on a Subinterface, page 5 (optional) Monitoring NetFlow Subinterfaces, page 7 (optional) Configuring NetFlow on a Distributed VIP Interface, page 9 (optional) Enabling NetFlow on a Subinterface SUMMARY STEPS Perform the following task to enable NetFlow on a subinterface. This feature allows the enabling of NetFlow only on a specific subinterface. NetFlow always exported subinterface information. 1. enable 2. configure terminal 3. interface type slot/port.subinterface-number [multipoint point-to-point] or interface type slot/port-adapter.subinterface-number [multipoint point-to-point] or interface type slot/port-adapter/port.subinterface-number [multipoint point-to-point] 4. ip address ip-address mask [secondary] 5. ip flow ingress 6. end 7. show ip cache flow 3

4 How to Enable and Monitor NetFlow on Subinterfaces Enabling and Monitoring NetFlow on Subinterfaces DETAILED STEPS Step 1 Step 2 Command or Action enable Router> enable configure terminal Purpose Enables privileged EXEC mode. Enter your password if prompted. Enters global configuration mode. Step 3 Step 4 Step 5 Router# configure terminal interface type slot/port.subinterface-number [multipoint point-to-point] or interface type slot/port-adapter.subinterface-number [multipoint point-to-point] or interface type slot/port-adapter/port.subinterface-number [multipoint point-to-point] Router(config)# fastethernet6/3.0 or Router(config)# fastethernet6/1.0 or Router(config)# fastethernet6/1/2.1 ip address ip-address mask [secondary] Router(config-if)# ip address ip flow ingress Selects the subinterface on which to enable NetFlow. The type argument is the type of interface to be configured. The slot argument is the slot number. Refer to the appropriate hardware manual for slot and port information. The /port-adapter argument is the port adapter number. Refer to the appropriate hardware manual for information about port adapter compatibility. The /port argument is the port number. Refer to the appropriate hardware manual for slot and port information. Note Use the slot/port.subinterface-number argument for the Cisco 7200 series router. Use the slot/port-adapter.subinterface-number argument for the Cisco 7500 series router. Use the slot/port-adapter/port.subinterface-number argument for the Cisco 7500 series router with ports on VIP cards. Sets a primary or secondary IP address for an interface. The ip-address argument is the ip address of the interface. The mask argument is the mask for the associated IP subnet. The secondary keyword specifies that the configured address is a secondary IP address. If this keyword is omitted, the configured address is the primary IP address. Enables NetFlow on a subinterface. Router(config-subif)# ip flow ingress 4

5 Enabling and Monitoring NetFlow on Subinterfaces How to Enable and Monitor NetFlow on Subinterfaces Step 6 Command or Action end Purpose Exits to privileged EXEC mode. Step 7 Router(config-subif)# end show ip cache flow Displays a summary of the NetFlow switching statistics. Router# show ip cache flow Managing the Display of NetFlow Statistics on a Subinterface SUMMARY STEPS DETAILED STEPS Perform the following task to manage the display of NetFlow statistics on a subinterface. You can display and clear NetFlow statistics. NetFlow statistics consist of information about IP packet size distribution, IP flow cache information, and flow information such as the protocol, total flow, flows per second, and so on. You can use the results to gather information about your router traffic. 1. enable 1. show ip cache flow 2. clear ip flow stats 3. show ip cache flow 4. exit Step 1 Step 2 enable Use this command to enable privileged EXEC mode. Enter a password if prompted. For example: Router> enable Router# show ip cache flow Use this command to display a summary of NetFlow statistics. For example: Router# show ip cache flow IP packet size distribution (120 total packets): IP Flow Switching Cache, bytes 8 active, inactive, 8 added 26 ager polls, 0 flow alloc failures Active flows timeout in 30 minutes Inactive flows timeout in 15 seconds IP Sub Flow Cache, bytes 5

6 How to Enable and Monitor NetFlow on Subinterfaces Enabling and Monitoring NetFlow on Subinterfaces 8 active, inactive, 8 added, 8 added to flow 0 alloc failures, 0 force free 1 chunk, 1 chunk added last clearing of statistics never Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) Flows /Sec /Flow /Pkt /Sec /Flow /Flow SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts Se2/ Local Step 3 Step 4 clear ip flow stats Use this command to clear NetFlow statistics on the router. For example: Router# clear ip flow stats show ip cache flow Use this command to verify that the NetFlow statistics are cleared from the router. For example: Router# show ip cache flow IP packet size distribution (0 total packets): IP Flow Switching Cache, bytes 0 active, 4096 inactive, 0 added 0 ager polls, 0 flow alloc failures Active flows timeout in 30 minutes Inactive flows timeout in 15 seconds IP Sub Flow Cache, bytes 0 active, 1024 inactive, 0 added, 0 added to flow 0 alloc failures, 0 force free 1 chunk, 0 chunks added last clearing of statistics 00:00:11 Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) Flows /Sec /Flow /Pkt /Sec /Flow /Flow SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts Se2/ Local Router# Step 5 exit Use this command to exit to user EXEC mode. For example: Router# exit 6

7 Enabling and Monitoring NetFlow on Subinterfaces How to Enable and Monitor NetFlow on Subinterfaces Monitoring NetFlow Subinterfaces Perform the following tasks to monitor NetFlow subinterfaces. SUMMARY STEPS 1. enable 2. show ip cache flow 3. show ip flow export 4. show ip interface 5. exit DETAILED STEPS Step 1 Step 2 enable Use this command to enable privileged EXEC mode. Enter a password if prompted. For example: Router> enable Router# show ip cache flow Use this command to display NetFlow statistics on the subinterface and display the cache configuration for the configured subinterface. For example: Router# show ip cache flow IP packet size distribution (120 total packets): IP Flow Switching Cache, bytes 8 active, inactive, 8 added 26 ager polls, 0 flow alloc failures Active flows timeout in 30 minutes Inactive flows timeout in 15 seconds IP Sub Flow Cache, bytes 8 active, inactive, 8 added, 8 added to flow 0 alloc failures, 0 force free 1 chunk, 1 chunk added last clearing of statistics never Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) Flows /Sec /Flow /Pkt /Sec /Flow /Flow SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts Et0/ Et0/2/ Step 3 show ip flow export Use this command to display the cache flow statistics for a subinterface. For example: Router# show ip flow export Flow export v5 is enabled for main cache Exporting flows to (9995) 7

8 How to Enable and Monitor NetFlow on Subinterfaces Enabling and Monitoring NetFlow on Subinterfaces Exporting using source IP address Version 5 flow records 0 flows exported in 0 udp datagrams 0 flows failed due to lack of export packet 0 export packets were sent up to process level 0 export packets were dropped due to no fib 0 export packets were dropped due to adjacency issues 0 export packets were dropped due to fragmentation failures 0 export packets were dropped due to encapsulation fixup failures Router# Step 4 show ip interface Use this command to display the usability status of a subinterface configured for IP. For example: Router# show ip interface Ethernet0 is up, line protocol is up Internet address is , subnet mask is Broadcast address is Address determined by non-volatile memory MTU is 1500 bytes Helper address is not set Secondary address , subnet mask Directed broadcast forwarding is enabled Multicast groups joined: Outgoing access list is not set Inbound access list is not set Proxy ARP is enabled Security level is default Split horizon is enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent IP fast switching is enabled IP fast switching on the same interface is disabled IP Flow switching is enabled IP CEF switching is enabled IP Subif flow switching turbo vector IP multicast fast switching is enabled IP route-cache flags are Fast, Flow init, CEF, Ingress Flow IP SSE switching is disabled Router Discovery is disabled IP output packet accounting is disabled IP access violation accounting is disabled TCP/IP header compression is disabled Probe proxy name replies are disabled WCCP Redirect outbound is enabled WCCP Redirect exclude is disabled Step 5 In this example, the IP route-cache flags includes Ingress Flow, which indicates that NetFlow is enabled on a subinterface. exit Use this command to exit to user EXEC mode. For example: Router# exit 8

9 Enabling and Monitoring NetFlow on Subinterfaces How to Enable and Monitor NetFlow on Subinterfaces Configuring NetFlow on a Distributed VIP Interface Perform the following task to configure NetFlow on a distributed VIP interface. NetFlow Support on Cisco 7500 VIP Controllers SUMMARY STEPS DETAILED STEPS On a Cisco 7500 series router with an Route Switch Processor (RSP) and with VIP controllers, the VIP hardware can be configured to switch packets received by the VIP with no per-packet intervention on the part of the RSP. This process is called distributed switching. When VIP distributed switching is enabled, the input VIP interface switches IP packets instead of forwarding them to the RSP for switching. Distributed switching decreases the demand on the RSP. The VIP hardware with distributed switching enabled can be configured for NetFlow. Using VIP hardware, you can export NetFlow data to network management applications. Cisco 7500 VIP controllers are supported in Cisco IOS Releases 12.2(14)S, 12.0(22)S, and 12.2(15)T. 1. enable 2. configure terminal 3. interface type slot/port-adapter/port 4. ip address ip-address mask [secondary] 5. ip route-cache distributed 6. ip route-cache flow 1 7. ip flow-export destination ip-address udp-port 8. end Step 1 Step 2 Command or Action enable Router> enable configure terminal Purpose Enables privileged EXEC mode. Enter your password if prompted. Enters global configuration mode. Router# configure terminal 9

10 How to Enable and Monitor NetFlow on Subinterfaces Enabling and Monitoring NetFlow on Subinterfaces Step 3 Step 4 Step 5 Step 6 Command or Action interface type slot/port-adapter/port Router(config)# fastethernet 6/1/2 ip address ip-address mask [secondary] Router(config-if)# ip address ip route-cache distributed Router(config-if)# ip route-cache distributed ip route-cache flow Purpose Specifies the interface, and enters interface configuration mode. The type argument is the type of interface to be configured. The slot argument is the slot number. Refer to the appropriate hardware manual for slot and port information. The /port-adapter argument is the port adapter number. Refer to the appropriate hardware manual for information about port adapter compatibility. The /port argument is the port number. Refer to the appropriate hardware manual for slot and port information. Sets a primary or secondary IP address for an interface. The ip-address argument is the ip address of the interface. The mask argument is the mask for the associated IP subnet. The secondary keyword specifies that the configured address is a secondary IP address. If this keyword is omitted, the configured address is the primary IP address. Enables VIP distributed switching of IP packets on the interface. Enables NetFlow on the VIP. Step 7 Step 8 Router(config-if)# ip route-cache flow ip flow-export destination ip-address udp-port Router(config-if)# ip flow-export destination end Enables the export of information stored in NetFlow cache entries. The ip-address argument is the IP address of the workstation to which you want to send the NetFlow information. The udp-port argument is the protocol-specific port number of the workstation to which you want to send the NetFlow information. Use this command to export NetFlow cache entries to a workstation when a flow expires. Exits to privileged EXEC mode. Router(config)# end 10

11 Enabling and Monitoring NetFlow on Subinterfaces Configuration Examples for Enabling and Monitoring NetFlow on Subinterfaces Configuration Examples for Enabling and Monitoring NetFlow on Subinterfaces This section contains configuration examples for enabling and monitoring NetFlow on a subinterface or VIP interface: Enabling NetFlow on a Subinterface: Example, page 11 Configuring NetFlow on a Distributed VIP Interface: Example, page 11 Enabling NetFlow on a Subinterface: Example The following example shows how to configure NetFlow on subinterface Fast Ethernet 6/3.0: configure terminal! interface FastEthernet6/3.0 ip address ip flow ingress exit Configuring NetFlow on a Distributed VIP Interface: Example The following example shows how to configure NetFlow on a distributed VIP interface: configure terminal! interface fastethernet6/1/2 ip address ip route-cache distributed ip route-cache flow ip flow-export destination end Additional References The following sections provide references related to enabling and monitoring NetFlow on a subinterface or VIP interface. Related Documents Related Topic List of the features documented in the Cisco IOS NetFlow Configuration Guide Overview of the NetFlow application and advanced NetFlow features and services Tasks for configuring basic NetFlow to capture and export network data Document Title Cisco IOS NetFlow Features Roadmap Cisco IOS NetFlow Overview Configuring NetFlow to Capture and Export Network Traffic Data 11

12 Additional References Enabling and Monitoring NetFlow on Subinterfaces Related Topic Tasks for configuring egress NetFlow accounting Tasks for configuring MPLS egress NetFlow accounting Tasks for configuring NetFlow input filters Tasks for configuring random sampled NetFlow Tasks for customizing the main NetFlow cache Tasks for configuring aggregation caches and aggregation schemes Tasks for configuring multiple export destinations for Netflow data Tasks for selecting and configuring a NetFlow data export format Tasks for configuring NetFlow BGP next hop support Tasks for configuring NetFlow multicast support Tasks for configuring MPLS-aware NetFlow Tasks for configuring the SNMP NetFlow MIB Tasks for configuring the NetFlow MIB and Top Talkers feature Document Title Configuring Egress NetFlow Accounting to Capture Outgoing NetFlow Traffic Configuring MPLS Egress NetFlow Accounting Using NetFlow Filtering or Sampling to Select the Network Traffic to Track Using NetFlow Filtering or Sampling to Select the Network Traffic to Track Customizing the Main NetFlow Cache Configuring NetFlow Aggregation Caches and Schemes Configuring Multiple Export Destinations for NetFlow Data Selecting and Configuring a NetFlow Data Export Format Configuring NetFlow BGP Next Hop Support for Accounting and Analysis Configuring NetFlow Multicast Accounting Configuring MPLS-aware NetFlow Configuring SNMP and the NetFlow MIB to Monitor NetFlow Data Configuring the NetFlow MIB and Top Talkers to Analyze Selected NetFlow Traffic Data Standards Standards No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. Title 12

13 Enabling and Monitoring NetFlow on Subinterfaces Glossary MIBs MIBs No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. MIBs Link To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: RFCs RFCs No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature. Title Technical Assistance Description The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content. Link Glossary CEF Cisco Express Forwarding. Layer 3 IP switching technology that optimizes network performance and scalability for networks with large and dynamic traffic patterns. dcef Distributed Cisco Express Forwarding. A type of CEF switching in which line cards (such as VIP line cards) maintain an identical copy of the forwarding information base (FIB) and adjacency tables. The line cards perform the express forwarding between port adapters; this relieves the Route Switch Processor of involvement in the switching operation. flow A set of packets with the same source IP address, destination IP address, protocol, source and destination ports, and type-of-service, and the same interface on which flow is monitored. Ingress flows are associated with the input interface, and egress flows are associated with the output interface. ISP Internet service provider. A company that provides Internet access to other companies and individuals. NetFlow A Cisco IOS accounting feature for maintaining per-flow data. subinterface A logical network layer interface over a physical interface. VIP Versatile Interface Processor. An interface card used in Cisco 7000 and Cisco 7500 series routers. The VIP provides multilayer switching and tunes Cisco IOS. 13

14 Feature Information for Enabling and Monitoring NetFlow on Subinterfaces Enabling and Monitoring NetFlow on Subinterfaces Note Refer to the Cisco Dictionary of Internetworking Terms and Acronyms for terms not included in this glossary. Feature Information for Enabling and Monitoring NetFlow on Subinterfaces Table 1 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Releases 12.2(14)S, 12.2(15)T, 12.0(22)S, or a later release appear in the table. Not all commands may be available in your Cisco IOS software release. For details on when support for a specific command was introduced, see the command reference documentation. For information on a feature in this technology that is not documented here, see the Cisco IOS NetFlow Features Roadmap. Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear. Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature. 14

15 Enabling and Monitoring NetFlow on Subinterfaces Feature Information for Enabling and Monitoring NetFlow on Subinterfaces Table 1 Feature Information for Enabling and Monitoring NetFlow on Subinterfaces Feature Name Releases Feature Configuration Information NetFlow Subinterface Support 12.2(14)S, 12.0(22)S 12.2(15)T The NetFlow Subinterface Support feature provides the ability to enable NetFlow on a per-subinterface basis. The following sections provide information about this feature: NetFlow Subinterface Configuration Benefits: Fine-Tuning Your Data Collection, page 2 Effect of the ip route-cache flow Command on NetFlow Subinterface Configuration, page 2 Enabling NetFlow on a Subinterface, page 3 Managing the Display of NetFlow Statistics on a Subinterface, page 5 Monitoring NetFlow Subinterfaces, page 7 Configuring NetFlow on a Distributed VIP Interface, page 9 The following command was introduced by this feature: ip flow ingress. The following command was modified by this feature: show ip interface. CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iquick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iq Expertise, the iq logo, iq Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, TeleRouter, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0502R) Copyright 2005 Cisco Systems, Inc. All rights reserved. This module first published May 2, Last updated May 2,

16 Feature Information for Enabling and Monitoring NetFlow on Subinterfaces Enabling and Monitoring NetFlow on Subinterfaces 16