Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router This module describes the configuration of NetFlow on the Cisco ASR 9000 Series Aggregation Services Router. A NetFlow flow is a unidirectional sequence of packets that arrive on a single interface ( subinterface), and have the same values f key fields. NetFlow is useful f the following: Accounting/Billing NetFlow data provides fine grained metering f highly flexible and detailed resource utilization accounting. Netwk Planning and Analysis NetFlow data provides key infmation f strategic netwk planning. Netwk Moniting NetFlow data enables near real-time netwk moniting capabilities. Feature Histy f Configuring NetFlow on Cisco IOS XR Software Release Modification Release 3.9.1 This feature was introduced. Release 4.0 IPv6 Multicast Netflow suppt was added on Cisco ASR 9000's A9K-SIP-700. Contents This module includes the following sections: Prerequisites f Configuring NetFlow, page RC-2 Restrictions f Configuring NetFlow, page RC-2 Infmation About Configuring NetFlow, page RC-2 How to Configure NetFlow on Cisco IOS XR Software, page RC-8 Trident Netflow, page RC-23 Additional References, page RC-26 RFCs, page RC-27 NFC-1

Prerequisites f Configuring NetFlow Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Prerequisites f Configuring NetFlow To perfm these configuration tasks, your Cisco IOS XR software system administrat must assign you to a user group associated with a task group that includes the cresponding command task IDs. If you need assistance with your task group assignment, contact your system administrat. Restrictions f Configuring NetFlow Consider the following restrictions when configuring NetFlow in Cisco IOS XR software: When the Netflow router is configured at the tail-end of the PW tunnel, the Netflow ingress is unable to recd the PW traffic in the cache. This behavi is because of the egress microcode limitation f L2VPN which cannot handle the Netflow start offset packets. The egress microcode disables the ingress Netflow processing f the SNF ingress start offset packets and hence these packets are not included in the Netflow statistics. In IOS XR, Netflow implementation happens using fast path. You must configure a source interface. If you do not configure a source interface, the expter will remain in a disabled state. Cisco IOS XR software suppts expt fmat Version 9 only. You must configure a valid recd map name f every flow monit map. Tip We recommend that you do not use the management interface to expt NetFlow packets. Expting the management interface does not wk efficiently. Infmation About Configuring NetFlow To implement NetFlow, you must understand the following concepts: NetFlow Overview, page RC-2 Monit Map Overview, page RC-3 Sampler Map Overview, page RC-3 Expter Map Overview, page RC-4 NetFlow Configuration Submodes, page RC-4 MPLS Flow Monit with IPv4 and IPv6 Suppt, page RC-7 NetFlow Overview A flow is expted as part of a NetFlow expt User Datagram Protocol (UDP) datagram under the following circumstances: The flow has been inactive active f too long. The flow cache is getting full. NFC-2

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Infmation About Configuring NetFlow One of the counters (packets and bytes) has wrapped. The user fces the flow to expt. NetFlow expt UDP datagrams are sent to an external flow collect device that provides NetFlow expt data filtering and aggregation. The expt of data consists of expired flows and control infmation. The NetFlow infrastructure is based on the configuration and use of the following maps: Monit map Sampler map Expter map These maps are described in the sections that follow. Monit Map Overview A monit map contains name references to the flow recd map and flow expter map. Monit maps are applied to an interface. You can configure the following monit map attributes: Number of entries in the flow cache Type of cache (permanent nmal). Permanent caches do not have their entries removed from the cache unless they are explicitly cleared by the user Active flow timeout Inactive flow timeout Update timeout Default timeouts Recd type of packets sampled and collected The recd name specifies the type of packets that NetFlow samples as they pass through the router. Currently, MPLS, IPv4, and IPv6 packet sampling is suppted. The active flow and inactive flow timeouts are associated with a nmal cache type. The update timeout is associated with the permanent cache type. Sampler Map Overview The sampler map specifies the rate at which packets (one out of n packets) are sampled. On high bandwidth interfaces, applying NetFlow processing to every single packet can result in significant CPU utilization. Sampler map configuration is typically geared towards such high speed interfaces. The Policer rate is based on the netwk process (NP). If netflow is applied on 1 NP, the aggregated maximum flow packet processing rate per line card (LC) is 100k flow packets per second (irrespective of the direction and the number of interface netflow that is applied in that NP). However, depending on the Netflow monit configuration distribution among NPs in an LC, policing of flow packet can take effect with an aggregated rate that is less than 100k. F example, if Netflow is applied to 1 interface per NP in a 4 NP LC, then the Policer rate per NP is 25K packets per second. NFC-3

Infmation About Configuring NetFlow Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Expter Map Overview An expter map contains user netwk specification and transpt layer details f the NetFlow expt packet. The flow expter-map command allows you to configure collect and version attributes. You can configure the following collect infmation: Expt destination IP address DSCP value f expt packet Source interface UDP pt number (This is where the collect is listening f NetFlow packets.) Transpt protocol f expt packets In Cisco IOS XR software, UDP is the only suppted transpt protocol f expt packets. NetFlow expt packets use the IP address that is assigned to the source interface. If the source interface does not have an IP address assigned to it, the expter will be inactive. You can also configure the following expt version attributes: Template timeout Template data timeout Template options timeout Interface table timeout Sampler table timeout A single flow monit map can suppt up to eight expters. NetFlow Configuration Submodes In Cisco IOS XR, NetFlow map configuration takes place in map-specific submodes. Cisco IOS XR suppts the following NetFlow map configuration submodes: Flow Expter Map Configuration Submode, page RC-5 Flow Expter Map Version Configuration Submode, page RC-5 Flow Monit Map Configuration Submode, page RC-6 Sampler Map Configuration Submode, page RC-6 Tip The Cisco IOS XR software allows you to issue most commands available under submodes as one single command string from global configuration mode. F example, you can issue the recd ipv4 command from the flow monit map configuration submode as follows: RP/0/RSP0/CPU0router(config)# flow monit-map fmm RP/0/RSP0/CPU0:router(config-fmm)# recd ipv4 NFC-4

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Infmation About Configuring NetFlow Alternatively, you can issue the same command from global configuration mode, as shown in the following example: RP/0/RSP0/CPU0:router(config)# flow monit-map fmm recd ipv4 Flow Expter Map Configuration Submode When you issue the flow expter-map fem-name command in global configuration mode, the command-line interface (CLI) prompt changes to config-fem, indicating that you have entered the flow expter map configuration submode. In the following sample output, the question mark (?) online help function displays all the commands available under the flow expter map configuration submode: RP/0/RSP0/CPU0:router(config)# flow expter-map fem RP/0/RP0/CPU0:router(config-fem)#? clear Clear the uncommitted configuration clear Clear the configuration commit Commit the configuration changes to running describe Describe a command without taking real actions destination Expt destination configuration do Run an exec command dscp Specify DSCP value f expt packets exit Exit from this submode no Negate a command set its defaults pwd Commands used to reach current submode root Exit to the global configuration mode show Show contents of configuration source Source interface transpt Specify the transpt protocol f expt packets version Specify expt version parameters If you enter the version command, you enter the flow expter map version configuration submode. A single flow monit map can suppt up to eight expters. Flow Expter Map Version Configuration Submode When you issue the version v9 command in the flow expter map configuration submode, the CLI prompt changes to config-fem-ver, indicating that you have entered the flow expter map version configuration submode. In the following sample output, the question mark (?) online help function displays all the commands available under the flow expter map version configuration submode: RP/0/RSP0/CPU0:router(config-fem)# version v9 RP/0/RP0/CPU0:router(config-fem-ver)#? commit Commit the configuration changes to running describe Describe a command without taking real actions do Run an exec command exit Exit from this submode NFC-5

Infmation About Configuring NetFlow Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router no Negate a command set its defaults options Specify expt of options template show Show contents of configuration template Specify template expt parameters Flow Monit Map Configuration Submode When you issue the flow monit-map map_name command in global configuration mode, the CLI prompt changes to config-fmm, indicating that you have entered the flow monit map configuration submode. In the following sample output, the question mark (?) online help function displays all the commands available under the flow monit map configuration submode: RP/0/RSP0/CPU0:router(config)# flow monit-map fmm RP/0/RSP0/CPU0:router(config-fmm)#? cache Specify flow cache attributes commit Commit the configuration changes to running describe Describe a command without taking real actions do Run an exec command exit Exit from this submode expter Specify flow expter map name no Negate a command set its defaults recd Specify a flow recd map name show Show contents of configuration RP/0/RSP0/CPU0:router(config-fmm)# Sampler Map Configuration Submode When you issue the sampler-map map_name command in global configuration mode, the CLI prompt changes to config-sm, indicating that you have entered the sampler map configuration submode. In the following sample output, the question mark (?) online help function displays all the commands available under the sampler map configuration submode: RP/0/RSP0/CPU0(config)# sampler-map fmm RP/0/RSP0/CPU0:router(config-sm)#? clear Clear the uncommitted configuration clear Clear the configuration commit Commit the configuration changes to running describe Describe a command without taking real actions do Run an exec command exit Exit from this submode no Negate a command set its defaults pwd Commands used to reach current submode random Use random mode f sampling packets root Exit to the global configuration mode show Show contents of configuration RP/0/RSP0/CPU0(config-sm)#RP/0/RP0/CP0:router(config-sm)# Enabling the NetFlow BGP Data Expt Function Use the bgp attribute-download command to enable NetFlow BGP routing attribute collection. The routing attributes are then expted. When no routing attributes are collected, zeroes (0) are expted. NFC-6

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Infmation About Configuring NetFlow When BGP attribute download is enabled, BGP downloads the attribute infmation f prefixes (community, extended community, and as-path) to the Routing Infmation Base (RIB) and Fwarding Infmation Base (FIB). This enables FIB to associate the prefixes with attributes and send the NetFlow statistics along with the associated attributes. MPLS Flow Monit with IPv4 and IPv6 Suppt Cisco IOS XR Software Release suppts the NetFlow collection of MPLS packets. It also suppts the NetFlow collection of MPLS packets carrying IPv4, IPv6, both IPv4 and IPv6 payloads. MPLS Cache Reganization to Suppt Both IPv4 and IPv6 In Cisco IOS XR Software Release, at a time, you can have only one MPLS flow monit running on an interface. If you apply an additional MPLS flow monit to the interface, the new flow monit overwrites the existing one. At a time, you can apply only one flow monit on an interface per direction. You can apply either the same flow monit to an interface in both directions, each direction can have its own flow monit. You can configure the MPLS flow monit to collect IPv4 fields, IPv6 fields, IPv4-IPv6 fields. IPv4-IPv6 configuration collects both IPv4 and IPv6 addresses using one MPLS flow monit. IPv4 configuration collects only IPv4 addresses. IPv6 configuration collects only IPv6 addresses. The MPLS flow monit suppts up to 1,000,000 cache entries. NetFlow entries include the following types of fields: IPv4 fields IPv6 fields MPLS with IPv4 fields MPLS with IPv6 fields The maximum number of bytes per NetFlow cache entry is as follows: IPv4 88 bytes per entry MPLS 88 bytes per entry IPv6 108 bytes per entry MPLS with IPv4 fields 108 bytes per entry MPLS with IPv6 fields 128 bytes per entry The different types of NetFlow entries are sted in separate caches. Consequently, the number of NetFlow entries on a line card can significantly impact the amount of available memy on the line card. Also, even though the sampling rate f IPv6 is the same as the sampling rate f IPv4, the CPU utilization f IPv6 is higher due to the longer keys used by the IPv6 fields. MPLS Packets with IPv6 Flows The collection of IPv6 flows in MPLS packets is an option. The CPU uses 128 bytes f each IPv6 field. IPv6 flows may contain the following types of infmation: Source IP address NFC-7

How to Configure NetFlow on Cisco IOS XR Software Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Destination IP address Traffic class value Layer 4 protocol number Layer 4 source pt number Layer 4 destination pt number Flow ID Header option mask To collect the IPv6 fields in MPLS packets, you must activate the MPLS recd type, ipv6-fields by running the recd mpls ipv6-fields command. You can also specify the number of labels to be used f aggregation with this command. How to Configure NetFlow on Cisco IOS XR Software The steps that follow provide a general overview of NetFlow configuration: Step 1 Step 2 Create and configure an expter map. Create and configure a monit map and a sampler map. The monit map must reference the expter map you created in Step 1. If you do not apply an expter-map to the monit-map, the flow recds are not expted, and aging is done accding to the cache parameters specified in the monit-map. Step 3 Apply the monit map and sampler map to an interface. These steps are described in detail in the following sections: Configuring an Expter Map, page RC-8 Configuring a Sampler Map, page RC-11 Configuring a Monit Map, page RC-12 Applying a Monit Map and a Sampler Map to an Interface, page RC-16 Clearing NetFlow Data, page RC-17 Configuring NetFlow Collection of MPLS Packets with IPv6 Fields, page RC-18 Configuring an Expter Map Configure an expter map and apply it to the monit map with the flow monit-map map_name expter map_name command. You can configure the expter map pri to configuring the monit map, you can configure the monit map first and then configure and apply an expter map later on. Cisco IOS XR software suppts the configuration of a single collect only in the expter map. The steps that follow describe how to create and configure an expter map. NFC-8

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router How to Configure NetFlow on Cisco IOS XR Software SUMMARY STEPS 1. configure 2. flow expter-map map_name 3. destination hostname IP_address 4. dscp dscp_value 5. source type interface-path-id 6. transpt udp pt 7. version v9 8. options {interface-table sampler-table} [timeout seconds] 9. template [data options] timeout seconds 10. end commit 11. exit 12. exit 13. show flow expter-map map_name DETAILED STEPS Step 1 Command Action configure Enters global configuration mode. Step 2 Step 3 Step 4 Step 5 RP/0/RSP0/CPU0:router# configure flow expter-map map_name RP/0/RSP0/CPU0:router(config)# flow expter-map fem destination hostname IP_address RP/0/RSP0/CPU0:router(config-fem)# destination nnn.nnn.nnn.nnn dscp dscp_value RP/0/RSP0/CPU0:router(config-fem)# dscp 55 source type interface-path-id RP/0/RSP0/CPU0:router(config-fem)# source gigabitethernet 0/0/0/0 Creates an expter map, configures the expter map name, and enters flow expter map configuration mode. Configures the expt destination f the flow expter map. The destination can be a hostname an IP address. (Optional) Specifies the differentiated services codepoint (DSCP) value f expt packets. Replace the dscp_value argument with a value in the range from 0 through 63. Specifies a source interface, in the fmat type interface-path-id. NFC-9

How to Configure NetFlow on Cisco IOS XR Software Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Command Action transpt udp pt RP/0/RSP0/CPU0:router(config-fem)# transpt udp 9991 version v9 RP/0/RSP0/CPU0:router(config-fem-ver)# version v9 options {interface-table sampler-table} [timeout seconds] RP/0/RSP0/CPU0:router(config-fem-ver)# options sampler-table timeout 2000 template [data options] timeout seconds RP/0/RSP0/CPU0:router(config-fem-ver)# template data timeout 10000 end commit RP/0/RSP0/CPU0:router (config-fem-ver)# end RP/0/RSP0/CPU0:router(config-fem-ver)# commit exit (Optional) Specifies the destination pt f UDP packets. Replace pt with the destination UDP pt value, in the range from 1024 through 65535. (Optional) Enters flow expter map version configuration submode. (Optional) Configures the expt timeout value f the sampler table. Replace seconds with the expt timeout value, in the range from 1 through 604800 seconds. Default is 1800 seconds. (Optional) Configures the expt period f data packets. Replace seconds with the expt timeout value, in the range from 1 through 604800 seconds. Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them befe exiting(yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session. Exits flow expter map version configuration submode. RP/0/RSP0/CPU0:router(config-fem-ver)# exit NFC-10

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router How to Configure NetFlow on Cisco IOS XR Software Step 12 Command Action exit Enters EXEC mode. Step 13 RP/0/RSP0/CPU0:router(config)# exit show flow expter-map map_name Displays expter map data. RP/0/RSP0/CPU0:router# show flow expter-map fem Configuring a Sampler Map SUMMARY STEPS DETAILED STEPS The steps that follow describe how to create and configure a sampler map. 1. configure 2. sampler-map map_name 3. random 1 out-of sampling_interval 4. end commit 5. exit 6. exit 7. show sampler-map map_name Step 1 Command Action configure Enters global configuration mode. Step 2 Step 3 RP/0/RSP0/CPU0:router# configure sampler-map map_name RP/0/RSP0/CPU0:router(config)# sampler-map fsm RP/0/RSP0/CPU0:router(config-sm)#f random 1 out-of sampling_interval RP/0/RSP0/CPU0:router(config-sm)# random 1 out-of 65535 Creates a sampler map and enters sampler map configuration mode. Keep the following in mind when configuring a sampler map: Configures the sampling interval to use random mode f sampling packets. Replace the sampling_interval argument with a number, in the range from1 through 65535 units. NFC-11

How to Configure NetFlow on Cisco IOS XR Software Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Step 4 Step 5 Step 6 Command Action end commit RP/0/RSP0/CPU0:router (config-sm)# end RP/0/RSP0/CPU0:router (config-sm)# commit exit RP/0/RSP0/CPU0:router(config-sm)# exit exit Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them befe exiting(yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session. Exits sampler map configuration mode and enters global configuration mode. Exits global configuration mode and enters EXEC mode. Step 7 RP/0/RSP0/CPU0:router(config)# exit show sampler-map map_name Displays sampler map data. RP/0/RSP0/CPU0:router# show sampler-map fsm Configuring a Monit Map SUMMARY STEPS The steps that follow describe how to create and configure a monit map. 1. configure 2. flow monit-map map_name 3. recd ipv4 recd ipv4 [peer as] recd ipv6 NFC-12

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router How to Configure NetFlow on Cisco IOS XR Software recd mpls recd mpls [ipv4-fields] [labels number] recd mpls [ipv6-fields] [labels number] recd mpls [ipv4-ipv6-fields] [labels number] 4. cache entries number 5. cache permanent 6. cache timeout {active inactive upate} timeout_value 7. expter map_name 8. end commit 9. exit 10. exit 11. show flow monit-map map_name DETAILED STEPS Step 1 Command Action configure Enters global configuration mode. Step 2 RP/0/RSP0/CPU0:router# configure flow monit-map map_name RP/0/RSP0/CPU0:router(config)# flow monit-map fmm RP/0/RSP0/CPU0:router(config-fmm)# Creates a monit map and configures a monit map name and enters flow monit map configuration submode. NFC-13

How to Configure NetFlow on Cisco IOS XR Software Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Step 3 Step 4 Step 5 Command Action recd ipv4 recd ipv4 [peer as] recd ipv6 recd mpls [labels number] recd mpls [ipv4-fields] [labels number] recd mpls [ipv6-fields] [labels number] recd mpls [ipv4-ipv6-fields] [labels number] RP/0/RSP0/CPU0:router(config-fmm)# recd ipv4 cache entries number RP/0/RSP0/CPU0:router(config-fmm)# cache entries 10000 cache permanent Configures the flow recd map name f IPv4, IPv6, MPLS. Use the recd ipv4 command to configure the flow recd map name f IPv4. By default, you collect and expt the iginating autonomous system (AS) numbers. Use the recd ipv4 [peer as] command to recd peer AS. Here, you collect and expt the peer AS numbers. Ensure that the bgp attribute-download command is configured. Else, no AS is collected when the recd ipv4 [peer-as] command is configured. Use the recd ipv6 command to configure the flow recd map name f IPv6. Use the recd mpls labels command with the number argument to specify the number of labels that you want to aggregate. By default, MPLS-aware NetFlow aggregates the top six labels of the MPLS label stack. The maximum value is 6. Use the recd mpls ipv4-fields command to collect IPv4 fields in the MPLS-aware NetFlow. Use the recd mpls ipv6-fields command to collect IPV6 fields in the MPLS-aware NetFlow. Use the recd mpls ipv4-ipv6-fields command to collect IPv4 and IPv6 fields in the MPLS-aware NetFlow. (Optional) Configures the number of entries in the flow cache. Replace the number argument with the number of flow entries allowed in the flow cache, in the range from 4096 through 1000000. The default number of cache entries is 65535. (Optional) Disables removal of entries from flow cache. RP/0/RSP0/CPU0:router(config-fmm)# flow monit-map fmm cache permanent NFC-14

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router How to Configure NetFlow on Cisco IOS XR Software Step 6 Step 7 Step 8 Step 9 Command Action cache timeout {active timeout_value inactive timeout_value upate timeout_value} RP/0/RSP0/CPU0:router(config-fmm)# cache timeout inactive 1000 expter map_name RP/0/RSP0/CPU0:router(config-fmm)# expter fem end commit RP/0/RSP0/CPU0:router(config-fmm)# end RP/0/RSP0/CPU0:router(config-fmm)# commit exit (Optional) Configures the active, inactive, update flow cache timeout value. The default timeout value f the inactive flow cache is 15 seconds. The default timeout value f the active flow cache is 1800 seconds. The default timeout value f the update flow cache is 1800 seconds. The update timeout_value keywd argument is used f permanent caches only. It specifies the timeout value that is used to expt entries from permanent caches. In this case, the entries are expted but remain the cache. Associates an expter map with a monit map. A single flow monit map can suppt up to eight expters. Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them befe exiting(yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session. Exits flow monit map configuration submode. RP/0/RSP0/CPU0:router(config-fmm)# exit NFC-15

How to Configure NetFlow on Cisco IOS XR Software Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Step 10 Command Action exit Exits global configuration mode. Step 11 RP/0/RSP0/CPU0:router(config)# exit show flow monit-map map_name Displays flow monit map data. RP/0/RSP0/CPU0:router# show flow monit-map fmm Applying a Monit Map and a Sampler Map to an Interface SUMMARY STEPS DETAILED STEPS The steps that follow describe how to apply a monit map and a sampler map to an interface. 1. configure 2. interface type number 3. flow [ipv4 ipv6 mpls] monit monit_map sampler sampler_map {egress ingress} 4. end commit Step 1 Command Action configure Enters global configuration mode. Step 2 RP/0/RSP0/CPU0:router# configure interface type number Enters interface configuration mode. RP/0/RSP0/CPU0:router(config)# interface gigabitethernet 0/0/0/0 RP/0/RSP0/CPU0:router(config-if)# NFC-16

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router How to Configure NetFlow on Cisco IOS XR Software Step 3 Step 4 Command Action flow [ipv4 ipv6 mpls] monit monit_map sampler sampler_map {egress ingress} RP/0/RSP0/CPU0:router(config-if)# flow ipv4 monit fmm sampler fsm egress end commit RP/0/RSP0/CPU0:router(config-if)# end RP/0/RSP0/CPU0:router(config-if)# commit Associates a monit map and a sampler map with an interface. Enter ipv4 to enable IPV4 NetFlow on the specified interface. Enter ipv6 to enable IPV6 NetFlow on the specified interface. Enter mpls to enable MPLS-aware NetFlow on the specified interface. Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them befe exiting(yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session. Clearing NetFlow Data The steps that follow describe how to clear flow expter map and flow monit map data. SUMMARY STEPS 1. clear flow expter [expter_name] {restart statistics} location node-id 2. clear flow monit [monit_name] cache [fce-expt statistics] location node-id} NFC-17

How to Configure NetFlow on Cisco IOS XR Software Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router DETAILED STEPS Command Action Step 1 clear flow expter [expter_name] {restart statistics} location node-id Step 2 RP/0/RSP0/CPU0:router# clear flow expter statistics location 0/0/CPU0 clear flow monit [monit_name] cache [fce-expt statistics] location node-id} RP/0/RSP0/CPU0:router# clear flow monit cache fce-expt location 0/0/CPU0 Clears the flow expter data. Specify the statistics option to clear expter statistics. Specify the restart option to expt all of the templates that are currently configured on the specified node. Clears the flow monit data. Specify the statistics option to clear cache statistics. Specify the fce-expt option to expt the data from cache to server first and then clear the entries from cache. Configuring NetFlow Collection of MPLS Packets with IPv6 Fields The following steps show how to configure NetFlow collection of MPLS packets with IPv6 fields. SUMMARY STEPS 1. configure 2. flow expter-map map_name 3. version v9 4. options {interface-table sampler-table} [timeout seconds] 5. template [data options] timeout seconds 6. exit 7. transpt udp pt 8. source type interface-path-id 9. destination hostname IP_address 10. exit 11. flow monit-map map_name 12. recd mpls [ipv4-ipv6-fields] [labels number] 13. expter map_name 14. cache entries number 15. cache timeout {active timeout_value inactive timeout_value upate timeout_value} 16. cache permanent 17. sampler-map map_name 18. random 1 out-of sampling_interval 19. interface type number 20. flow [ipv4 ipv6 mpls] monit monit_map sampler sampler_map {egress ingress} NFC-18

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router How to Configure NetFlow on Cisco IOS XR Software 21. end commit 22. exit 23. exit 24. show flow monit-map map_name 25. show flow expter-map map_name DETAILED STEPS Step 1 Command Action configure Enters global configuration mode. Step 2 Step 3 Step 4 Step 5 Step 6 RP/0/RSP0/CPU0:router# config flow expter-map map_name RP/0/RSP0/CPU0:router(config)# flow expter-map exp1 version v9 RP/0/RSP0/CPU0:router(config-fem)# version v9 options {interface-table sampler-table} [timeout seconds] RP/0/RSP0/CPU0:router(config-fem-ver)# options interface-table timeout 300 template [data options] timeout seconds RP/0/RSP0/CPU0:router(config-fem-ver)# template data timeout 300 exit RP/0/RSP0/CPU0:router(config-fem-ver)# exit Creates an expter map, configures the expter map name, and enters flow expter map configuration mode. (Optional) Enters flow expter map version configuration submode. (Optional) Configures the expt timeout value f the interface table the sampler table. Replace seconds with the expt timeout value, in the range from 1 through 604800 seconds. The default is 1800 seconds f both the interface table and the sample table. You must perfm this step twice to configure the expt timeout value f both an interface table and a sample table. (Optional) Configures the expt period f data packets options packets. Replace seconds with the expt timeout value, in the range from 1 through 604800 seconds. You must perfm this step twice to configure the expt period f both data packets and options packets. Exits flow expter map version configuration mode, and enters flow expter map configuration mode. NFC-19

How to Configure NetFlow on Cisco IOS XR Software Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Step 7 Step 8 Step 9 Step 10 Step 11 Step 12 Step 13 Step 14 Command Action transpt udp pt RP/0/RSP0/CPU0:router(config-fem)# transpt udp 12515 source type interface-path-id RP/0/RSP0/CPU0:router(config-fem)# source Loopback0 destination hostname IP_address RP/0/RSP0/CPU0:router(config-fem)# destination 170.1.1.11 exit RP/0/RSP0/CPU0:router(config-fem)# exit flow monit-map map_name RP/0/RSP0/CPU0:router(config)# flow monit-map MPLS-IPv6-fmm recd mpls [ipv4-ipv6-fields] [labels number] RP/0/RSP0/CPU0:router(config-fmm)# recd mpls ipv6-fields labels 3 expter map_name RP/0/RSP0/CPU0:router(config-fmm)# expter exp1 cache entries number RP/0/RSP0/CPU0:router(config-fmm)# cache entries 10000 (Optional) Specifies the destination pt f UDP packets. Replace pt with the destination UDP pt value, in the range from 1024 through 65535. Specifies a source interface, in the fmat type interface-path-id. F example: POS 0/1/0/1 Loopback0 Configures the expt destination f the flow expter map. The destination can be a hostname an IP address. Exits flow expter map configuration mode, and enters flow expter map configuration mode. Creates a monit map and configures a monit map name and enters flow monit map configuration submode. Configures the flow recd map name f IPv4, IPv6, MPLS. Use the ipv4-ipv6-fields keywd to collect IPv4 and IPv6 fields in an MPLS-aware NetFlow. Associates an expter map with a monit map. A single flow monit map can suppt up to eight expters. (Optional) Configures the number of entries in the flow cache. Replace the number argument with the number of flow entries allowed in the flow cache, in the range from 4096 through 1000000. The default number of cache entries is 65535. NFC-20

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router How to Configure NetFlow on Cisco IOS XR Software Step 15 Step 16 Step 17 Command Action cache timeout {active timeout_value inactive timeout_value upate timeout_value} RP/0/RSP0/CPU0:router(config-fmm)# cache timeout inactive 1800 cache permanent RP/0/RSP0/CPU0:router(config-fmm)# flow monit-map fmm cache permanent exit (Optional) Configures the active, inactive, update flow cache timeout value. The default timeout value f the inactive flow cache is 15 seconds. The default timeout value f the active flow cache is 1800 seconds. The default timeout value f the update flow cache is 1800 seconds. The inactive and active keywds are not applicable to permanent caches. The update keywd is used f permanent caches only. It specifies the timeout value that is used to expt entries from permanent caches. In this case, the entries are expted but remain the cache. (Optional) Disables the removal of entries from flow cache. Exits flow monit map configuration submode. Step 18 Step 19 Step 20 Step 21 RP/0/RP0/CPU0:router(config-fmm)# exit sampler-map map_name RP/0/RSP0/CPU0:router(config)# sampler-map fsm RP/0/RSP0/CPU0:router(config-sm)# random 1 out-of sampling_interval RP/0/RSP0/CPU0:router(config-sm)# random 1 out-of 65535 exit RP/0/RSP0/CPU0:router(config-sm)# exit interface type number Creates a sampler map and enters sampler map configuration mode. Keep the following in mind when configuring a sampler map: Configures the sampling interval to use random mode f sampling packets. Replace the sampling_interval argument with a number, in the range from1 through 65535 units. Exits sampler map configuration mode and enters global configuration mode. Enters interface configuration mode. RP/0/RSP0/CPU0:router(config)# interface gigabitethernet 0/0/0/0 RP/0/RSP0/CPU0:router(config-if)# NFC-21

How to Configure NetFlow on Cisco IOS XR Software Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Step 22 Step 23 Step 24 Step 25 Command Action flow [ipv4 ipv6 mpls] monit monit_map sampler sampler_map {egress ingress} RP/0/RSP0/CPU0:router(config-if)# flow ipv4 monit MPLS-IPv6-fmm sampler fsm egress end commit RP/0/RSP0/CPU0:router (config-fem-ver)# end RP/0/RSP0/CPU0:router(config-fem-ver)# commit exit RP/0/RSP0/CPU0:router(config-if)# exit exit Associates a monit map and a sampler map with an interface. Enter ipv4 to enable IPV4 NetFlow on the specified interface. Enter ipv6 to enable IPV6 NetFlow on the specified interface. Enter mpls to enable MPLS-aware NetFlow on the specified interface. Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them befe exiting(yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session. Exits interface configuration submode f the Ethernet interface. Exits global configuration mode. Step 26 RP/0/RSP0/CPU0:router(config)# exit show flow monit-map map_name Displays flow monit map data. Step 27 RP/0/RSP0/CPU0:router# show flow monit-map fmm show flow expter-map map_name Displays expter map data. RP/0/RSP0/CPU0:router# show flow expter-map fem NFC-22

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router How to Configure NetFlow on Cisco IOS XR Software Trident Netflow Trident Netflow expts using only the V9 (Version 9) fmat. V9 is the most flexible NetFlow expt. This fmat is flexible and extensible. It provides the flexibility to suppt new fields and recd types. Suppted features Punt path policer rate Calculating Punt path policer rate Flow monit type of IPv4, IPv6, and MPLS can all be configured to an interface per direction. Sampled Netflow. There is no suppt f full mode sampling. Non-deterministic Random Sampling Algithm. Different traffic types, including unicast and multicast traffic. In der to achieve the maximum flow processing without overloading the LC CPU, all flow packets that are punted from each Netwk Process are policed. This is done to avoid overloading the CPU. The aggregate punt policer rate is 100 Kpps. To avoid having flow packets arrive at the CPU at a huge rate, the punt path policer needs to be applied on all NPs that have the netflow feature applied on them. The Punt path policer rate can be calculated in following way: The policer rate of each NP_NetflowMonit is 100k, where NP_NetflowMonit is NP that has Netflow monit configured to its associated interfaces; any of its associated interfaces are member of a bundle interfaces bundle sub-interfaces that has Netflow monit applied. Determining NP f NP_NetflowMonit non - NP_NetflowMonit: 1. If any of its associated interface sub-interface has any flow monit applied, then it is NP_NetflowMonit. 2. If any of its interfaces is a member of a bundle interface bundle sub-interface that has Netflow monit configured, the NP is considered as non- NP_NetflowMonit. Trident base line cards suppted features Suppts ingress and egress Netflow (IPv4, IPv6, MPLS) on L3 physical interface, L3-sub-interface, L3-Bundle interface, and L3 bundle sub-interface. Suppts configurable Sampling Rate 1:1 ~ 1: 65535 Suppts only up to 4 Sampling Rates ( Intervals) per LC. Suppts up to 8k (Large memy LC) 4k (Small Memy LC) interfaces/subinterfaces Suppts configuration with flow monit per NP. Suppts maximum aggregate Netflow processing rate of 50k flow packets per seconds per LC, enfced by Netflow Punt Policer on each NPs. Suppts netflow processing of 100Kpps, with CPU utilization not exceeding 50%. Suppts up to 4 flow expters per flow monit. Suppts expting packet rates of up to 100k flows per second. NFC-23

Configuration Examples f NetFlow Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Configuration Examples f NetFlow The following examples show NetFlow configurations: Sampler Map: Example, page RC-24 Expter Map: Example, page RC-24 Flow Monit Map: Examples, page RC-24 MPLS Flow Monit with IPv4 and IPv6 Suppt, page RC-7 Sampler Map: Example The following example shows how to create a new sampler map called fsm1, which samples 1 out of 65535 packets: RP/0/RSP0/CPU0:router(config)# sampler-map fsm1 RP/0/RSP0/CPU0:router(config-sm)# random 1 out-of 65535 RP/0/RSP0/CPU0:router(config)# exit Expter Map: Example The following example shows how to create a new flow expter map called fem1, which uses the version 9 (V9) expt fmat f NetFlow expt packets. The data template flow-set is inserted into the V9 expt packets once every 10 minutes, and the options interface table flow-set is inserted into the V9 expt packet. The expt packets are sent to the flow collect destination 10.1.1.1, where the source address is identical to the interface IP address of Loopback 0. The UDP destination pt is 1024, and the DSCP value is 10: RP/0/RSP0/CPU0router(config)# flow expter-map fem1 RP/0/RSP0/CPU0:router(config-fem)# destination 10.1.1.1 RP/0/RSP0/CPU0:router(config-fem)# source Loopback 0 RP/0/RSP0/CPU0:router(config-fem)# transpt udp 1024 RP/0/RSP0/CPU0:router(config-fem)# dscp 10 RP/0/RSP0/CPU0:router(config-fem)# exit RP/0/RSP0/CPU0:router(config-fem)# version v9 RP/0/RSP0/CPU0router(config-fem-ver)# template data timeout 600 RP/0/RSP0/CPU0:router(config-fem-ver)# options interface-table RP/0/RSP0/CPU0:router(config-fem-ver)# exit Flow Monit Map: Examples The following example shows how to create a new flow monit map with name fmm1. This flow monit map references the flow expter map fem1, and sets the flow cache attributes to 10000 cache entries. The active entries from the cache are aged every 30 seconds, while the inactive entries from the cache are aged every 15 seconds. The recd map f this monit map is IPv4: RP/0/RSP0/CPU0:router(config)# flow monit-map fmm1 RP/0/RSP0/CPU0:router(config-fmm)# recd ipv4 RP/0/RSP0/CPU0:router(config-fmm)# expter fem1 RP/0/RSP0/CPU0:router(config-fmm)# cache entries 10000 RP/0/RSP0/CPU0:router(config-fmm)# cache timeout active 30 RP/0/RSP0/CPU0:router(config-fmm)# cache timeout inactive 15 RP/0/RSP0/CPU0:router(config-fmm)# exit NFC-24

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Configuration Examples f NetFlow The following example shows how to apply the flow monit fmm1 and the sampler fsm1 to the TenGigE 0/0/0/0 interface in the ingress direction: RP/0/RSP0/CPU0:router(config)# interface TenGigE 0/0/0/0 RP/0/RSP0/CPU0:router(config-if)# flow ipv4 monit fmm1 sampler fsm1 ingress RP/0/RSP0/CPU0:router(config-if)# exit The following example shows how to configure the NetFlow monit to collect MPLS packets with IPv6 fields: RP/0/RSP0/CPU0:router# config RP/0/RSP0/CPU0:routerconfig)# flow expter-map exp1 RP/0/RSP0/CPU0:router(config-fem)# version v9 RP/0/RSP0/CPU0:router(config-fem-ver)# options interface-table timeout 300 RP/0/RSP0/CPU0:router(config-fem-ver)# options sampler-table timeout 300 RP/0/RSP0/CPU0:router(config-fem-ver)# template data timeout 300 RP/0/RSP0/CPU0:router(config-fem-ver)# template options timeout 300 RP/0/RSP0/CPU0:router(config-fem-ver)# exit RP/0/RSP0/CPU0:router(config-fem)# transpt udp 12515 RP/0/RSP0/CPU0:router(config-fem)# source Loopback0 RP/0/RSP0/CPU0:router(config-fem)# destination 170.1.1.11 RP/0/RSP0/CPU0:router(config-fmm)# exit RP/0/RSP0/CPU0:router(config)# flow monit-map MPLS-IPv6-fmm RP/0/RSP0/CPU0:router(config-fmm)# recd mpls ipv6-fields labels 3 RP/0/RSP0/CPU0:router(config-fmm)# expter exp1 RP/0/RSP0/CPU0:router(config-fmm)# cache entries 10000 RP/0/RSP0/CPU0:router(config-fmm)# cache permanent RP/0/RSP0/CPU0:router(config-fmm)# exit RP/0/RSP0/CPU0:router(config)# sampler-map FSM RP/0/RSP0/CPU0:router(config-sm)# random 1 out-of 65535 RP/0/RSP0/CPU0:router(config-sm)# exit RP/0/RSP0/CPU0:router(config)# interface gigabitethernet 0/0/0/0 RP/0/RSP0/CPU0:router(config-if)# flow mpls monit MPLS-IPv6-fmm sampler FSM ingress MPLS Flow Monit with IPv4 and IPv6 Suppt: Examples The following configuration collects MPLS traffic, but no payload infmation is collected. RP/0/RSP0/CPU0:router(config)# flow monit-map MPLS-fmm RP/0/RSP0/CPU0:router(config-fmm)# recd mpls labels 3 RP/0/RSP0/CPU0:router(config-fmm)# cache permanent RP/0/RSP0/CPU0:router(config)# exit RP/0/RSP0/CPU0:router(config)# interface gigabitethernet 0/0/0/0 RP/0/RSP0/CPU0:router(config-if)# flow mpls monit MPLS-fmm sampler fsm ingress The following configuration collects MPLS traffic with IPv4 payloads. It also collects MPLS traffic without IPv4 payloads, but it populates the IPv4 fields with zeros (0). RP/0/RSP0/CPU0:router(config)# flow monit-map MPLS-IPv4-fmm RP/0/RSP0/CPU0:router(config-fmm)# recd mpls IPv4-fields labels 3 RP/0/RSP0/CPU0:router(config-fmm)# cache permanent RP/0/RSP0/CPU0:router(config-fmm)# exit RP/0/RSP0/CPU0:routerrouter(config)# interface gigabitethernet 0/0/0/0 RP/0/RSP0/CPU0:router(config-if)# flow mpls monit MPLS-IPv4-fmm sampler fsm ingress NFC-25

Additional References Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router The following configuration collects MPLS traffic with IPv6 payloads. It also collects MPLS traffic without IPv6 payloads, but it populates the IPv6 fields with zeros (0). RP/0/RSP0/CPU0:router(config)# flow monit-map MPLS-IPv6-fmm RP/0/RSP0/CPU0:router(config-fmm)# recd mpls IPv6-fields labels 3 RP/0/RSP0/CPU0:router(config-fmm)# cache permanent RP/0/RSP0/CPU0:router(config-fmm)# exit RP/0/RSP0/CPU0:router(config)# interface gigabitethernet 0/0/0/0 RP/0/RSP0/CPU0:router(config-if)# flow mpls monit MPLS-IPv6-fmm sampler fsm ingress The following configuration collects MPLS traffic with both IPv6 and IPv4 fields. It also collects MPLS traffic without IPv4 IPv6 payloads, but it populates the IPv6 and IPv4 fields with zeros (0). RP/0/RSP0/CPU0:router(config)# flow monit-map MPLS-IPv4-IPv6-fmm RP/0/RSP0/CPU0:router(config-fmm)# recd mpls IPv4-IPv6-fields labels 3 RP/0/RSP0/CPU0:router(config-fmm)# cache permanent RP/0/RSP0/CPU0:router(config-fmm)# exit RP/0/RSP0/CPU0:router(config)# interface gigabitethernet 0/0/0/0 RP/0/RSP0/CPU0:router(config-if)# flow mpls monit MPLS-IPv4-IPv6-fmm sampler fsm ingress Flow recds are expted using the Version 9 fmat. Additional References The following sections provide references related to interface configuration. Related Documents Related Topic Cisco IOS XR master command reference Cisco IOS XR interface configuration commands Initial system bootup and configuration infmation f a router using the Cisco IOS XR software. Infmation about user groups and task IDs Infmation about configuring interfaces and other components on the Cisco CRS-1 Router from a remote Craft Wks Interface (CWI) client management application. Document Title Cisco IOS XR Master Commands List Cisco IOS XR Interface and Hardware Component Command Reference Cisco IOS XR Getting Started Guide Cisco IOS XR Interface and Hardware Component Command Reference Cisco Craft Wks Interface User Guide NFC-26

Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router Additional References Standards Standards No new modified standards are suppted by this feature, and suppt f existing standards has not been modified by this feature. Title MIBs MIBs MIBs Link To locate and download MIBs using Cisco IOS XR software, use the Cisco MIB Locat found at the following URL and choose a platfm under the Cisco Access Products menu: http://cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml RFCs RFCs Title 3954 NetFlow services expt protocol Version 9. Technical Assistance NFC-27

Additional References Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router NFC-28