Extended Flexible NetFlow record

Flexible NetFlow (FNF) configuration on Cisco devices with NBAR2 App Name support

1. FNF record - selection of entities and how to create the records

2. Exporter - where to export the records

3. Monitor - FNF record + exporter

4. Source of data - monitor on selected interfaces

Enable Cisco Express Forwarding:

ip cef

Create flow record:

flow record FNF_IPv4_extended_APP
description Extended Flexible NetFlow record for IPv4 with the application name
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
collect timestamp sys-uptime first
collect timestamp sys-uptime last
collect counter bytes
collect counter packets
collect transport tcp flags

collect ipv4 tos
collect datalink mac source address input
collect datalink mac source address output
collect datalink mac destination address input
collect datalink mac destination address output
collect datalink dot1q vlan input
collect datalink dot1q vlan output
collect interface input
collect interface output
collect routing destination as
collect routing source as
collect application name

Create flow exporter:

flow exporter FNF_exporter_1
description Exporter for Flexible NetFlow
destination 10.0.0.2
transport udp 2055
template data timeout 600

Turn on monitoring (monitor):

flow monitor FNF_IPv4_monitor_1
description Flexible NetFlow monitor 1 for IPv4
record FNF_IPv4_extended_APP
exporter FNF_exporter_1
cache timeout inactive 30
cache timeout active 300

Assign interface to the monitor (source of data):

interface Vlan3
ip flow monitor FNF_IPv4_monitor_1 input
ip flow monitor FNF_IPv4_monitor_1 output