|
|
This chapter describes how to configure NetFlow switching. For a complete description of NetFlow commands used in this chapter, refer to the "Cisco IOS Switching Commands" chapter in the Cisco IOS Switching Services Command Reference. For documentation on other commands that appear in this chapter, you can use the command reference master index or search online.
NetFlow switching is based on identifying packet flows and performing switching and access list processing within a router. It does not involve any connection-setup protocol either between routers or to any other networking device or end station and does not require any change externally---either to the traffic or packets themselves or to any other networking device. Thus, NetFlow switching is completely transparent to the existing network, including end stations and application software and network devices like LAN switches. Also, because NetFlow switching is performed independently on each internetworking device, it does not need to be operational on each router in the network. Network planners can selectively invoke NetFlow switching (and NetFlow data export) on a router or interface basis to gain traffic performance, control, or accounting benefits in specific network locations.
 |
Note NetFlow does consume additional memory and CPU resources compared to other switching modes; therefore, it is important to understand the resources required on your router before enabling NetFlow. |
To configure NetFlow Switching, complete the tasks in the following sections. At a minimum, you must enable NetFlow Switching. The remaining tasks are optional.
| Command | Purpose | |
|---|---|---|
Step 1 | interface type slot/port-adapter/port (Cisco 7500 series routers)interface type slot/port (Cisco 7200 series routers) | Specifies the interface, and enter interface configuration mode. |
Step2 | ip route-cache flow | Enables Netflow switching for IP routing. |
NetFlow switching information can also be exported to network management applications. To configure the router to export NetFlow switching statistics maintained in the NetFlow cache to a workstation when a flow expires, use one of the following commands in global configuration mode:
| Command | Purpose |
|---|---|
ip flow-export ip-address udp-port [version1] | Configures the router to export NetFlow cache entries to a workstation if you are using receiving software that requires version 1. Version 1 is the default. |
ip flow-export ip-address udp-port version5 [origin-as | peer-as] | Configures the router to export NetFlow cache entries to a workstation if you are using receiving software that accepts version 5. Optionally specify origin or peer autonomous system (AS). The default is to export neither AS which provides improved performance. |
To customize the number of entries in the NetFlow cache, use the following command in global configuration mode:
| Command | Purpose |
|---|---|
ip flow-cache entries number | Changes the number of entries maintained in the NetFlow cache. The number of entries can be 1024 to 524288. Thedefault is 65536. |
 |
CautionWe recommend that you not change the NetFlow cache entries. Improper use of this feature could cause network problems. To return to the default NetFlow cache entries, use the noipflow-cache entries global configuration command. |
You can display and clear NetFlow switching statistics. NetFlow statistics consist of IP packet size distribution, IP flow switching cache information, and flow information such as the protocol, total flow, flows per second, and so forth. The resulting information can be used to find out information about your router traffic. To manage NetFlow switching statistics, use either of the following commands in privileged EXEC mode:
| Command | Purpose |
|---|---|
show ip route flow | Displays the NetFlow switching statistics. |
clear ip flow stats | Clears the NetFlow switching statistics. |
On Cisco 7500 series routers with a Route Switch Processor (RSP) and with Versatile Interface Processor (VIP) controllers, the VIP hardware can be configured to switch packets received by the VIP with no per-packet intervention on the part of the RSP. This process is called distributed switching. Distributed switching decreases the demand on the RSP.
The VIP hardware can also be configured for NetFlow switching, a new high-performance feature that identifies initiation of traffic flow between internet endpoints, caches information about the flow, and uses this cache for high-speed switching of subsequent packets within the identified stream.
NetFlow switching data can also be exported to network management applications.
Refer to the Cisco Product Catalog for information about VIP port adapters used for distributed switching.
To configure distributed switching on the VIP, first configure the router for IP routing as described in this chapter and the various routing protocol chapters, depending on the protocols you use.
After you configure IP routing, use the following commands beginning in global configuration mode:
| Command | Purpose | |
|---|---|---|
Step1 | interface type slot/port-adapter/port | Specifies the interface, and enter interface configuration mode. |
Step2 | ip route-cache distributed | Enables VIP distributed switching of IP packets on the interface. |
Step3 | ip route-cache flow | Enables Netflow switching for IP routing. |
When the RSP or VIP is flow switching, it uses a flow cache instead of a destination network cache to switch IP packets. The flow cache uses source and destination network address, protocol, and source and destination port numbers to distinguish entries.
To export NetFlow switching cache entries to a workstation when a flow expires, use the following command in global configuration mode:
| Command | Purpose |
|---|---|
ip flow-export ip-address udp-port | Configures the router to export NetFlow cache entries to a workstation. |
To improve performance, fragmented IP packets are flow switched rather than being process switched by default on Cisco7500 series routers.
To configure an aggregation cache, you must enter aggregation cache configuration mode, and you must decide which type of aggregation scheme you would like to configure: autonomous system, Destination Prefix, Prefix, Protocol Prefix, or Source Prefix aggregation cache. Once you define the aggregation scheme, define the operational parameters for that scheme.
| Command | Purpose | |
|---|---|---|
Step1 | Router(config)#ip flow-aggregation cache as | Enters aggregation cache configuration mode and enables an aggregation cache scheme (as, destination-prefix, prefix, protocol-port, or source-prefix) |
Step2 | Router(config-flow-cache)#cache entries 2046 | Specifies the number (in this example, 2046) of cache entries to allocate for the autonomous system aggregation cache. |
Step3 | Router(config-flow-cache)#cache timeout inactive 199 | Specifies the number of seconds (in this example, 199) that an inactive entry is allowed to remain in the aggregation cache before it is deleted. |
Step4 | Router(config-flow-cache)#cache timeout active 45 | Specifies the number of minutes (in this example, 45) that an active entry is active. |
Step5 | Router(config-flow-cache)#export destination 10.42.41.1 9991 | Enables the data export. |
Step6 | Router(config-flow-cache)#enabled | Enables aggregation cache creation. |
To verify the aggregation cache information, use the following command in EXEC mode:
| Command | Purpose |
|---|---|
show ip cache flow aggregation | Displays the aggregation cache information. |
To confirm data export, use the following command in EXEC mode:
| Command | Purpose |
|---|---|
show ip flow export | Displays the statistics for the data export including the main cache and all other enabled caches. |
As long as policy routing is configured, NetFlow policy routing is enabled by default and cannot be disabled. That is, NPR is the default policy routing mode. No configuration tasks are required to enable policy routing in conjunction with CEF, dCEF, or NetFlow. As soon as one of these features is turned on, packets are automatically subject to policy routing in the appropriate switching path.
There is one new, optional configuration command (set ip next-hop verify-availability). This command has the following restrictions:
It is assumed that policy routing itself is already configured.
If the router is policy routing packets to the next hop and the next hop happens to be down, the router will try unsuccessfully to use Address Resolution Protocol (ARP) for the next hop (which is down). This behavior will continue forever.
To prevent this situation, you can configure the router to first verify that the next hop(s) of the route map is the router's CDP neighbor(s) before routing to that next hop.
This task is optional because some media or encapsulations do not support CDP, or it may not be a Cisco device that is sending the router traffic.
To configure the router to verify that the next hop is a CDP neighbor before the router tries to policy route to it, use the following command in route-map configuration mode:
| Command | Purpose |
|---|---|
set ip next-hop verify-availability | Causes the router to confirm that the next hop(s) of the route map is a CDP neighbor(s) of the router. |
If the command shown is set and the next hop is not a CDP neighbor, the router looks to the subsequent next hop, if there is one. If there is none, the packets simply are not policy routed.
If the command shown is not set, the packets are either successfully policy routed or remain forever unrouted.
If you want to selectively verify availability of only some next hops, you can configure different route-map entries (under the same route-map name) with different criteria (using access list matching or packet size matching), and use the set ip next-hop verify-availability command selectively.
Typically, you would use existing policy routing and NetFlow show commands to monitor these features. For more information on these show commands, refer to the policy routing and NetFlow documentation.
To display the route map Inter Processor Communication (IPC) message statistics in the RP or VIP, use the following command in EXEC mode:
| Command | Purpose |
|---|---|
show route-map ipc | Displays the route map IPC message statistics in the RP or VIP. |
This section provides the following basic configuration examples:
configure terminal interface serial 3/0/0 ip route-cache flow exit ip flow-export 1.1.15.1 0 version 5 peer-as exit clear ip flow stats
This section provides the following aggregation cache configuration examples:
The following example shows how to configure an autonomous system aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992.
Router(config)#ip flow-aggregation cache as Router(config-flow-cache)#cache entries 2046 Router(config-flow-cache)#cache timeout inactive 200 Router(config-flow-cache)#cache timeout active 45 Router(config-flow-cache)#export destination 10.42.42.1 9992 Router(config-flow-cache)#enabled
The following example shows how to configure a Destination Prefix aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992.
Router(config)#ip flow-aggregation cache destination-prefix Router(config-flow-cache)#cache entries 2046 Router(config-flow-cache)#cache timeout inactive 200 Router(config-flow-cache)#cache timeout active 45 Router(config-flow-cache)#export destination 10.42.42.1 9992 Router(config-flow-cache)#enabled
The following example shows how to configure a Prefix aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992.
Router(config)#ip flow-aggregation cache prefix Router(config-flow-cache)#cache entries 2046 Router(config-flow-cache)#cache timeout inactive 200 Router(config-flow-cache)#cache timeout active 45 Router(config-flow-cache)#export destination 10.42.42.1 9992 Router(config-flow-cache)#enabled
The following example shows how to configure a Protocol Port aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992.
Router(config)#ip flow-aggregation cache protocol-port Router(config-flow-cache)#cache entries 2046 Router(config-flow-cache)#cache timeout inactive 200 Router(config-flow-cache)#cache timeout active 45 Router(config-flow-cache)#export destination 10.42.42.1 9992 Router(config-flow-cache)#enabled
The following example shows how to configure a Source Prefix aggregation cache with a cache size of 2046, an inactive timeout of 200 seconds, a cache active timeout of 45 minutes, an export destination IP address of 10.42.42.1, and a destination port of 9992.
Router(config)#ip flow-aggregation cache source-prefix Router(config-flow-cache)#cache entries 2046 Router(config-flow-cache)#cache timeout inactive 200 Router(config-flow-cache)#cache timeout active 45 Router(config-flow-cache)#export destination 10.42.42.1 9992 Router(config-flow-cache)#enabled
The following example configures CEF, NetFlow, and NetFlow with flow acceleration. It also configures policy routing to verify that next hop 50.0.0.8 of route map test is a CDP neighbor before the router tries to policy route to it.
If the first packet is being policy routed via route map test sequence 10, the subsequent packets of the same flow always take the same route map test sequence 10, not route map test sequence 20, because they all match or pass access list 1 check. Therefore, policy routing can be flow-accelerated by bypassing the access-list check.
ip cef ip flow-cache feature-accelerate interface ethernet0/0/1 ip route-cache flow ip policy route-map test route-map test permit 10 match ip address 1 set ip precedence priority set ip next-hop 50.0.0.8 set ip next-hop verify-availability route-map test permit 20 match ip address 101 set interface Ethernet0/0/3 set ip tos max-throughput
Posted: Mon Jul 17 17:00:27 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.