cisco netflow配置

建议参考下Cisco官方文档/联系下cisco技术支持吧

Netflow - Cisco

Cisco IOS NetFlow - Cisco

cisco.com/c/dam/en/us/td/docs/security/stealthwatch/netflow/Cisco_NetFlow_Configuration.pdf

Netflow - 配置示例和技术说明 - Cisco

以下基于思科 ASR 1000 路由器的配置

1. 创建record

flow record Record_test1
match ipv4 destination address <<< 定义 key（所有的键值都必须匹配数据包才能计数，流会收集其他感兴趣的字段，存储在NetFlow cache中）
match ipv4 protocol
match ipv4 source address
match transport source-port
match transport destination-port
collect counter bytes long <<< 定义 non-key
collect counter packets long
collect timestamp sys-uptime first
collect timestamp sys-uptime last


2. 创建 exporter
flow exporter Exporter_test1
destination x.x.x.x <<< 流量监控器 ip 地址
source Loopback0 <<< 连接流量监控器的接口
transport udp 9999
export-protocol netflow-v5



3. 配置 Monitor
flow monitor MOnitor1
exporter Exporter_test1
record Record_test1


4. 在接口下应用
interface Loopback0
ip flow monitor MOnitor1 input <<< 采集接口下入向 ip 流量
ip address 1.1.1.1 255.255.255.0


5. 查看（目前物流量也没有 netflow 监控server）

#show ip cache flow
IP packet size distribution (0 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 0 bytes
0 active, 0 inactive, 0 added
0 ager polls, 0 flow alloc failures
Active flows timeout in 30 minutes
Inactive flows timeout in 15 seconds
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts