Cisco Flexible NetFlow Configuration Step by Step

Flexible NetFlow decouples what you collect from where you send it: a flow record defines the fields, a flow exporter defines the destination and transport, and a flow monitor binds them to an interface and cache. That three-part model is why the same platform can feed a capacity-planning collector with coarse records and a security collector with detailed ones simultaneously. This guide walks the build order with real syntax, explains which fields belong in the key versus non-key set, and covers the verification commands that confirm flows are actually being exported rather than merely cached.

Why Flexible NetFlow

Traditional NetFlow hard-codes the exported fields per export version. Flexible NetFlow lets you define user-defined records: you choose the match (key) fields that define a flow, and the collect (non-key) fields that describe it. The same device can then export IP-only aggregation for volumetric reporting and full 5-tuple plus timestamps for security analytics without running two features.

Step 1: flow record

flow record FLOW_RECORD-1
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 match transport source-port
 match transport destination-port
 match interface input
 collect counter bytes long
 collect counter packets long
 collect timestamp absolute first
 collect timestamp absolute last
 collect interface output

Every field in the match list becomes part of the flow key. Adding matches increases cache entries and reduces aggregation - the right choice for security, the wrong choice if you only want top-talker reporting. Non-key collect fields add no cache entries but do add export volume.

Step 2: flow exporter

flow exporter EXPORTER-1
 destination 10.10.10.50
 source Loopback0
 transport udp 9995
 export-protocol netflow-v9
 template data timeout 120
 option interface-table timeout 300

Template timeout is the parameter people forget: a collector that restarts after the template has expired receives data records it cannot decode. Two to five minutes is a common compromise between re-announcement overhead and collector restart tolerance. Sourcing exports from a loopback address keeps the collector's device identity stable across interface changes.

Step 3: flow monitor and cache

flow monitor MONITOR-1
 exporter EXPORTER-1
 record FLOW_RECORD-1
 cache timeout active 1
 cache timeout inactive 15

Active timeout forces a record out for long-lived flows; without it, a sustained elephant flow contributes nothing to your dashboards until it ends. Inactive timeout controls how quickly idle entries are reclaimed.

Step 4: apply to interfaces

interface GigabitEthernet1/0/1
 ip flow monitor MONITOR-1 input
 ip flow monitor MONITOR-1 output
!
interface GigabitEthernet1/0/48
 ip flow monitor MONITOR-1 input

Apply input on user-facing ports, and be selective about output on uplinks: monitoring every interface of a high-density chassis multiplies both CPU and export bandwidth. Where the device supports it, sampling reduces load but changes the meaning of your byte counters.

Verification

show flow record FLOW_RECORD-1
show flow exporter EXPORTER-1 statistics
show flow monitor MONITOR-1 cache format table
show flow monitor MONITOR-1 statistics
show running-config flow record

Check three things: the cache is accumulating entries, the exporter statistics show packets sent and no export errors, and the collector reports received flows. If the cache grows but the exporter counter stays flat, look for a routing or ACL problem on the source interface - exports follow the routing table, not the management path.

Where it fits

Flow export is the traffic-accounting layer next to performance telemetry. Compare the two models in gNMI streaming telemetry on IOS XE, and see Arista EOS sFlow configuration for the sampled-flow equivalent on another vendor. Combine with Zabbix SNMP switch monitoring with LLD for interface-level alerting.

原文链接：https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/17-17/configuration_guide/nmgmt/b_1717_nmgmt_9400_cg/configuring_flexible_netflow.html