Flexible Netflow on the Cisco 4500 Switch

Netflow is the very basic need which is required when troubleshooting Network slowness problems. Unfortunately Cisco 4500 switch does not have General/Traditional Netflow which we configure on Cisco Routers and Cisco 6500 switches etc. Cisco 4500 only supports Flexible Netflow which is basically Netflow V9. In this post I will guide you to configure Flexible Netflow in Cisco 4500 switch.

There are 4 steps to configure Flexible Netflow in Cisco 4500 switch:

• Create a flow record


• Create a flow exporter


• Create a flow monitor


• Apply the monitor to an interface

Step 1 : Create Flow record :

The flow record defines the fields that will be used to group traffic into unique flows. In my example, I used the following configuration:

flow record IPV4-FLOW-RECORD
    match ipv4 tos
    match ipv4 protocol
    match ipv4 source address
    match ipv4 destination address
    match transport source-port
    match transport destination-port
    collect interface input
    collect interface output
    collect counter bytes long
    collect counter packets long

Step 2 : Create Flow Export :

In flow exporter we configure the IP of netflow analyser tool which will receive Netflow data. By default, Cisco will send data to UDP Port 9995 but you can configure this port to any number. I have also configured Source Interface which is reachable from Netflow analyser server.

flow exporter Netflow_analyser
    destination 192.168.0.245
    source Loopback0
    transport udp 9995

Step 3 : Create Flow Monitor :

The flow monitor is where you link records and exporters together :

flow monitor IPV4-FLOW
    description Used for Monitoring IPv4 Traffic
    record IPV4-FLOW-RECORD
    exporter Netflow_analyser

Now its time to apply this to Interface where we want to enable Netflow.

Step 4 : Apply The Configuration :

First we will apply it to SVI vlan port :

4500(config)#vlan config 2  -----> This is Vlan number
4500(config-vlan-config)#ip flow monitor IPV4-FLOW input

Similarly we will apply to L3 port :

interface GigabitEthernet 0/1
     ip flow monitor IPV4-FLOW input

Show Commands to check Flexible Netflow is configured correctly :

4500#show flow ?
  exporter   Flow Exporter information
  interface  Flow interface information
  internal   Show the flow fields
  monitor    Flow Monitor information
  record     Show Flow Record configuration

You can check different parameters and configuration by using "show flow " command.



Thanks for reading my short post regarding Flexible Netflow on Cisco 4500 Switch.