Cisco Catalyst 3650/3850 (IPFIX/Netflow)

This is a basic guide to configure Cisco Catalyst 3650 or 3850 switches to output IPFIX or Netflow to a collector.

The Catalyst switch must be licensed for IP Base or IP Services. A LAN Base license may not enable full Netflow/IPFIX features. The Catalyst switch must also be running IOS XE version 3.6.xE, or 16.x or above.

Access the switch CLI

Connect to your Cisco Catalyst switch via SSH or a console cable. If connecting via SSH, use a tool like PuTTY or the built-in SSH client in your terminal, and enter the switch's IP address, username, and password to log in.

Enter global configuration mode

Once logged in, elevate to enable mode and then enter global configuration mode by typing the following command:

configure terminal

Configuring Netflow/IPFIX consists of 4 steps: configuring the flow record, the flow exporter, the flow monitor, and then applying the monitor to VLANs or Interfaces.

Step 1: Flow record configuration

Configure the flow record details. This is an example of how to match and collect common data to be exported in flow records. Many other options are available, so please reference Cisco documentation for a full list of options. Here we will create a new flow record called FLOWRECORD that we will reference later in the configuration.

flow record FLOWRECORD
description IPv4flow
match datalink vlan input
match datalink mac source address input
match datalink mac destination address input
match ipv4 tos
match ipv4 ttl
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
match flow direction
collect transport tcp flags
collect interface output
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last
collect counter bytes layer2 long

Step 2: Flow exporter configuration

Configure the flow exporter details next. We will create a new exporter called FLOWEXPORT that will be referenced later in the configuration. This is the collector that will be sent flow records from this device. Ensure you have the correct IP address and UDP port for the collector and that it is reachable from the source vlan or interface. You can also select the export-protocol to use here, either netflow or ipfix.

flow exporter FLOWEXPORT
destination 192.168.0.111
source Vlan100
transport udp 4739
export-protocol ipfix
template data timeout 240

Step 3: Flow monitor configuration

Configure the flow monitor details next. We will create a new monitor called FLOWMONITOR that will be referenced later in the configuration. This is the monitor that will be applied to VLANs or Interfaces in the next step. Make sure you reference the correct names of the record and exporter we configured earlier.

flow monitor FLOWMONITOR
exporter FLOWEXPORT
cache timeout active 60
record FLOWRECORD

Step 4: Apply monitor to VLANs or Interfaces

In the final step, we will turn on the flow export feature by applying the monitor to VLANs, interfaces, or both.

To capture flow records within a VLAN, use the following command. You can specificy a single VLAN or a range of VLANs by ID.

vlan configuration 1-4094
ip flow monitor FLOWMONITOR input

To capture flow records on a single interface, use the following configuration:

interface GigabitEthernet1/0/1
ip flow monitor FLOWMONITOR input

To save time, you can also apply the configuration to multiple interfaces with a single configuration by using the range command:

interface range gigabit 1/0/1 - 48
ip flow monitor FLOWMONITOR input

Save the configuration

Finally, exit configuration mode and save your configuration to flash so it starts again on a reboot:

copy running-config startup-config

Verify operation on the device

You can verify that flow records are being sent to the collector by running the following operational command:

show flow exporter FLOWEXPORT statistics 

If everything is operating correctly, you should see output similar to this:

Flow Exporter FLOWEXPORT:
  Packet send statistics (last cleared 3d00h ago):
    Successfully sent:         27333                 (9098972 bytes)

  Client send statistics:
    Client: Flow Monitor FLOWMONITOR
      Records added:           66318
        - sent:                66318
      Bytes added:             5239122
        - sent:                5239122