{"id":706,"date":"2017-06-02T22:00:37","date_gmt":"2017-06-02T21:00:37","guid":{"rendered":"http:\/\/www.balajibandi.com\/?p=706"},"modified":"2018-09-16T11:26:49","modified_gmt":"2018-09-16T10:26:49","slug":"cisco-nexus-7000-netflow-concepts-and-configuration","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=706","title":{"rendered":"Cisco Nexus 7000 NETFLOW Concepts and Configuration"},"content":{"rendered":"

Cisco Nexus 7000 NETFLOW Concepts and Configuration<\/span><\/strong><\/span><\/h1>\n

 <\/p>\n

One of the projects I\u2019m working on right now which needs to be implement to enable NetFlow feature on \u00a0a few pair of Nexus 7009s and export data to NTA(solarwinds).<\/p>\n

NetFlow is all about capturing network traffic statistics and use those statistics for planning and traffic engineering.<\/p>\n

Nexus supports NetFlow feature and it can be enabled using \u201cfeature netflow<\/em><\/strong>\u201d command, but lets understand how NetFlow works first.<\/p>\n

Cisco uses a process called NDE or NetFlow Data Export<\/strong> which exports the statistics gathered by NetFlow engine to a NetFlow Collector for storage and analysis.<\/p>\n

\"\"<\/p>\n

Nexus identifies a flow as a collection of packets which use the same value for one of these fields:<\/p>\n

    \n
  • Ingress interface<\/li>\n
  • Src-Dst ip address<\/li>\n
  • Protocol Number<\/li>\n
  • TOS (Type of Service)<\/li>\n
  • Src-Dst port<\/li>\n<\/ul>\n

    Nexus 7000 NetFlow entry creation happens at the hardware layer and it does not involve the CPU.<\/p>\n

    Each I\/O module has its own NetFlow Table and a NetFlow Client. When NetFlow is configured through CLI or XML services , NetFlow configuration then will be distributed to these NetFlow Clients.<\/p>\n

    NetFlow is supported by all M1, M2, M3, F1, F2,F3 and F4 cards using NX-OS 7.X and above.<\/p>\n

    SVI NetFlow is only supported when an L3 capable module is present in the switch.<\/p>\n

    NetFlow can be monitored constantly or can be monitored by taking samples. The benefit of using Sampled NetFlow is that it puts less load on the CPU vs. continues mode.<\/p>\n

    In order to configure NetFlow we need to follow a few steps.<\/p>\n

    \n
      \n
    1. –\u00a0 Enable NetFlow feature<\/li>\n
    2. – Create a Flow Record<\/li>\n
    3. – Create a Flow Exporter<\/li>\n
    4. – Create a Flow Monitor as assign it to an interface<\/li>\n<\/ol>\n<\/blockquote>\n

      NetFlow can be enabled like any other Nexus feature by running\u00a0\u201cfeature netflow<\/strong>\u201d<\/em>\u00a0in the config mode.<\/p>\n

      A Flow record is consisted of two types of statements :<\/p>\n

      \n
        \n
      1. 1. Match statements based on ip protocols\/tos , ipv4 src-dst , ipv6 src-dst , transport src-dst port , DataLink src-dst mac\/ethertype or vlan<\/li>\n
      2. 2. Collect statements based on counter(bytes\/packets), flow dirrection, interface (input\/output) and routing<\/li>\n<\/ol>\n<\/blockquote>\n

        Heere an example for a Flow Record which captures flow information based on ipv4 source and destination :<\/p>\n

        N7K01(config)#feature netflow
        \nN7K01(config)#flow record\u00a0IPV4-TRAFFIC
        \nN7K01(config-flow-record)#match ipv4 source address
        \nN7K01(config-flow-record)#match ipv4 destination address
        \nN7K01(config-flow-record)#collect counters packets
        \nN7K01(config-flow-record)#collect counters bytes<\/em><\/p><\/blockquote>\n

        Next step is to create a Flow Exporter. Using an exporter we are telling the NetFlow engine where to send the statistics it captured based on the Flow Records.<\/p>\n

        I\/O module CPU sends the flow information through Switched EOBC (Ethernet Out-Of-Band Channel) to the SUP module CPU. then the SUP module CPU will export the Flow to external NetFlow Collector through out of band mgmt0 or an inband destination via\u00a0Virtual Output Queues.<\/p>\n

        here is a sample flow exporter configuration :<\/p>\n

        N7K01(config)#flow exporter OPNET
        \nN7K01(config-flow-exporter)#destination 10.10.10.10 use-vrf management
        \nN7K01(config-flow-exporter)#source mgmt0
        \nN7K01(config-flow-exporter)#version 9
        \nN7K01(config-flow-exporter)#transport udp 2055<\/em><\/p><\/blockquote>\n

        Nexus supports both NetFlow v5.0 and v9.0. you need to select the protocol version and port number based on what your NetFlow Collector application supports.<\/p>\n

        Next step is to create a flow monitor which correlates the NetFlow Exporter and NetFlow Records together and assign them to the interface.<\/p>\n

        Here is an example :<\/p>\n

        N7K01(config)#flow monitor FLOWMON<\/em>
        \nN7K01(config-flow-monitor)#exporter OPNET<\/em>
        \nN7K01(config-flow-monitor)#record IPV4-TRAFFIC<\/em>
        \nN7K01(config-flow-monitor)# exit<\/em>
        \nN7K01(config)#interface eth 1\/16<\/em>
        \nN7K01(config-if)#ip flow monitor FLOWMON input<\/em>
        \nN7K01(config-if)#ip flow monitor FLOWMON output<\/em><\/p><\/blockquote>\n

        As I mentioned before, using Sampled NetFlow \u00a0it will have lower impact on the processor, here is sample configuration while having a Sampler configured:<\/p>\n

        N7K01(config)#sampler NF-SAMPLER
        \nN7K01(config-flow-sampler)#description sampler for eth1\/16
        \nN7K01(config-flow-sampler)#mode 1 out-of 1000
        \nN7K01(config-flow-sampler)#exit
        \nN7K01(config)#interface eth 1\/16
        \nN7K01(config-if)#ip flow monitor FLOWMON input sampler NF-SAMPLER
        \nN7K01(config-if)#ip flow monitor FLOWMON output sampler NF-SAMPLER<\/em><\/p><\/blockquote>\n

         <\/p>\n

        SOLARWIND NTA EXAMPLE Configuration :<\/p>\n

        Example Nexus 7000 Config, flexible v9 specific –\u00a0<\/span>All NTA versions<\/span><\/p>\n

        \n
        \n
        \n
        \n

        !
        \nflow record ipv4
        \nmatch ipv4 tos
        \nmatch ipv4 protocol
        \nmatch ipv4 source address
        \nmatch ipv4 destination address
        \nmatch transport source-port
        \nmatch transport destination-port
        \nmatch interface input
        \ncollect interface output
        \ncollect counter bytes
        \ncollect counter packets
        \n!
        \nflow exporter NetFlow-to-Orion
        \ndestination 10.10.10.10\u00a0(ip address of Orion server)
        \nsource vlan254\u00a0(interface with IP address Orion is managing the device with)
        \ntransport udp 2055\u00a0(Netflow collector port)
        \nexport-protocol Netflow version 9
        \ntemplate data timeout 60\u00a0(This will ensure the template is exported every 1 minute, default is 600 seconds)
        \n!
        \nflow monitor NetFlow-Monitor
        \ndescription Original Netflow captures
        \nrecord ipv4
        \nexporter NetFlow-to-Orion
        \ncache timeout inactive 10
        \ncache timeout active 1
        \n!
        \nvlan configuration 777
        \nip flow monitor NetFlow-Monitor input
        \n!<\/p>\n<\/div>\n

        Happy Labbbiiiiiiiiiiiiiiiiiiiing !<\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

        Cisco Nexus 7000 NETFLOW Concepts and Configuration   One of the projects I\u2019m working on right now which needs to be implement to enable NetFlow feature on \u00a0a few pair of Nexus 7009s and export data to NTA(solarwinds). NetFlow is all about capturing network traffic statistics and use those statistics for planning and traffic engineering. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,25,2],"tags":[],"class_list":["post-706","post","type-post","status-publish","format-standard","hentry","category-ccie-rns","category-ccie-dc","category-cisco"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/706","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=706"}],"version-history":[{"count":1,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/706\/revisions"}],"predecessor-version":[{"id":709,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/706\/revisions\/709"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=706"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=706"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=706"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}