- Cisco IOS NetFlow Overview
- Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export
- Configuring NetFlow and NetFlow Data Export
- Configuring NetFlow Aggregation Caches
- Configuring NetFlow BGP Next Hop Support for Accounting and Analysis
- Configuring NetFlow BGP Next Hop Support for Accounting and Analysis
- Configuring NetFlow Multicast Accounting
- Configuring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands
- Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- Finding Feature Information
- Prerequisites for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- Restrictions for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- Information About NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- How to Configure NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces
- Sample Network
- Configuring a GRE IP Tunnel
- Verifying the Status of the GRE IP Tunnel
- Configuring NetFlow Accounting on a GRE IP Tunnel Interface
- Configuring NetFlow Accounting on the Physical Interfaces
- Verifying NetFlow Accounting
- Configuring NetFlow Data Export Using the Version 9 Export Format
- Verifying That NetFlow Data Export Is Operational
- Configuration Examples for NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces
- Additional References
- Feature Information for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
This document contains information about and instructions for configuring NetFlow Accounting for Unicast and Multicast on generic routing encapsulation (GRE) IP Tunnel Interfaces. NetFlow multicast accounting allows you to capture multicast-specific data (both packets and bytes) for multicast flows.
NetFlow is a Cisco IOS application that provides statistics on packets flowing through a router. It is emerging as a primary network accounting and security technology.
- Finding Feature Information
- Prerequisites for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- Restrictions for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- Information About NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- How to Configure NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces
- Configuration Examples for NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces
- Additional References
- Feature Information for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- You must use the Per-interface NetFlow feature in conjunction with the NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces feature.
- The instructions for configuring IPv4 unicast routing are not included in this document. If you want to configure NetFlow accounting for IPv4 unicast traffic on a GRE IP interface, your switch must already be configured for IPv4 unicast routing.
- The instructions for configuring IPv4 multicast routing are not included in this document. If you want to configure NetFlow accounting for IPv4 multicast traffic on a GRE IP interface, your switch must already be configured for IPv4 multicast routing.
Restrictions for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
- Only Catalyst 6500 series switches with a supervisor 720 is supported.
- Multicast flow packet and byte counters will be updated only in PFC3B mode and above.
- Only hardware switched flows are supported.
- Only Version 9 NetFlow data export format is supported.
Information About NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
GRE Tunneling
Generic routing encapsulation (GRE) tunneling is defined in RFC 2784. GRE is a carrier protocol that can be used with a variety of underlying transport protocols and that can carry a variety of passenger protocols. RFC 2784 also covers the use of GRE with IPv4 as the transport protocol and the passenger protocol. For more information on GRE tunnels, see the Cisco IOS Interface and Hardware Component Configuration Guide . The figure below is an example of a typical implementation of a GRE IP tunnel.
Figure 1 | Sample Network with a GRE IPv4 Tunnel |
![](/c/dam/en/us/td/i/200001-300000/270001-280000/271001-272000/271760.eps/_jcr_content/renditions/271760.jpg)
GRE Tunnel Keepalive
Keepalive packets can be configured to be sent over IP-encapsulated GRE tunnels. You can specify the rate at which keepalives will be sent and the number of times that a device will continue to send keepalive packets without a response before the interface becomes inactive. GRE keepalive packets may be sent from both sides of a tunnel or from just one side.
Tunnel Interfaces
A tunnel interface is used to pass protocol traffic across a network that does not normally support the protocol. To build a tunnel requires defining a tunnel interface on each of two routers. The tunnel interfaces must reference each other. At each router, the tunnel interface must be configured with a Layer 3 address. The tunnel endpoints, tunnel source, and tunnel destination must be defined, and the type of tunnel must be selected. Optional steps can be performed to customize the tunnel.
Remember to configure the router at each end of the tunnel. If only one side of a tunnel is configured, the tunnel interface may still come up and stay up (unless keepalive is configured), but packets going into the tunnel will be dropped.
In Cisco IOS Release 12.2(8)T and later releases, Cisco express forwarding (CEF) switching over multipoint GRE tunnels was introduced. Previously, only process switching was available for multipoint GRE tunnels.
NetFlow Accounting on GRE IP Tunnel Interfaces
To analyze traffic that is sent from c3825 to c3745 in the figure below, NetFlow accounting is configured as shown in the table below. The flows in the "Flows" column are shown in the Unicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (Encapsulation) figure through the Multicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (De-encapsulation) figure.
Table 1 | Where to Configure NetFlow Accounting and Which NetFlow Commands to Configure |
Encapsulation/ De-encapsulation |
Router |
Ingress Physical Interface |
Ingress Tunnel Interface |
Egress Physical Interface |
Egress Tunnel Interface |
Flows |
---|---|---|---|---|---|---|
Traffic Direction |
||||||
Unicast over GRE (encap) |
C650002 |
ip flow ingress on interface gigabit 3/1 |
No configuration |
No configuration |
ip flow egress on interface tunnel 0 |
Flow (1) Flow (2) |
C3825 to C3745 |
||||||
Unicast over GRE (decap) |
C65003 |
ip flow ingress on interface gigabit 5/2 |
ip flow ingress on interface tunnel 0 |
No configuration |
No configuration |
Flow (1) Flow (2) |
C3825 to C3745 |
||||||
Multicast over GRE (encap) |
C650002 |
ip flow ingress on interface gigabit 3/1 |
No configuration |
ip flow egress on interface 6/2 |
ip flow egress on interface tunnel 0 |
Flow (1) Flow (2) Flow (3) |
C3825 to 3C745 |
||||||
Multicast over GRE (decap) |
C65003 |
ip flow ingress on interface gigabit 5/2 |
ip flow ingress on interface tunnel 0 |
ip flow egress on interface 1/1 |
No configuration |
Flow (1) Flow (2) Flow (3) |
C3825 to C3745 |
When you configure NetFlow accounting for IPv4 unicast traffic on a GRE tunnel interface, the traffic that is encapsulated or de-encapsulated on the router results in the creation of two flows. See the Unicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (Encapsulation) figure and the Unicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (De-encapsulation) figure. When you configure NetFlow accounting for IPv4 multicast traffic on a GRE tunnel interface, the traffic that is encapsulated or de-encapsulated on the router results in the creation of three flows. See the Multicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (Encapsulation) figure and the Multicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (De-encapsulation) figure. The increase in the number of flows created results in an increase in the usage of the hardware NetFlow table. You must monitor the hardware NetFlow table on your router to ensure that it is not oversubscribed.
If you are using NetFlow data export, the number of exported flows is also increased. Flows from the hardware table are converted to the Version 9 export format and then exported. Because the number of flows is doubled when you configure NetFlow Data Export, twice as much memory is required to convert the flows to Version 9 export format and then export them.
The table below provides the definitions of the terms used in the figures below.
Table 2 | Definition of Terms Used in Figures 2 through 5 |
Term |
Definition |
---|---|
encapsulation |
Adding the GRE tunnel header and trailer to the beginning and end respectively, of the packet being transmitted over the GRE tunnel. |
de-encapsulation |
Removing the GRE tunnel header and trailer from the beginning and end respectively, of the packet being received from the GRE tunnel. |
ingress |
The inbound path of traffic. For example, the ingress interface is the interface over which traffic is received. |
egress |
The outbound path of traffic. For example, the egress interface is the interface over which traffic is transmitted. |
ID |
Destination IP address. |
IS |
Source IP address. |
TD |
Destination IP address for the tunnel interface. |
TS |
Source IP address for the tunnel interface. |
MD |
Multicast destination IP address. |
MS |
Multicast source IP address. |
payload |
The packet data. |
The figure below shows the packet encapsulation process for unicast IPv4 traffic that is received on interface Gigabit Ethernet 3/1 on c65002 in the figure above. The first flow is the result of NetFlow accounting for the traffic after it is received on physical interface 3/1 (ingress NetFlow). The second flow is the result of NetFlow accounting for the traffic as it is being transmitted on the GRE tunnel interface T0 (egress NetFlow).
Figure 2 | Unicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (Encapsulation) |
![](/c/dam/en/us/td/i/200001-300000/270001-280000/271001-272000/271761.eps/_jcr_content/renditions/271761.jpg)
The figure below shows the packet de-encapsulation process for unicast IPv4 traffic that is received on interface Gigabit Ethernet 3/1 on c65002 in the Sample Network with a GRE IPv4 Tunnel figure. The first flow is the result of NetFlow accounting for the traffic after it is received on the physical interface 5/2 (ingress NetFlow). The second flow is the result of NetFlow accounting for the traffic as it is being received and de-encapsulated on the tunnel interface T0 (ingress NetFlow).
Figure 3 | Unicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (De-encapsulation) |
![](/c/dam/en/us/td/i/200001-300000/270001-280000/271001-272000/271762.eps/_jcr_content/renditions/271762.jpg)
During de-encapsulation, only ingress features of the tunnel are applied on the packets, and during encapsulation, only egress features of the tunnel are applied.
Multicast replication can happen in either ingress or egress mode. GRE encapsulation of multicast flows is done on the line card on which the ingress physical interface resides, irrespective of the ingress or egress replication mode. So in the case of both ingress and egress multicast replication modes, egress flows are created on the ingress line card.
The examples in the figures below show how and why multiple flows are created during GRE handling of packets. In the figure below, Flow 1 is created when packets are received by physical interface 3/1. Flows 2 and 3 are created as part the multicast replication process using the internal virtual local area networks (VLANs) that are required for NetFlow accounting to keep track of the multicast traffic.
Figure 4 | Multicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (Encapsulation) |
![](/c/dam/en/us/td/i/200001-300000/270001-280000/271001-272000/271763.eps/_jcr_content/renditions/271763.jpg)
In the figure below, Flow 1 is created when packets are received over physical interface 5/2. Flow 2 is created as part of the de-encapsulation process. Flow 3 is created as the multicast traffic is replicated and forwarded on interface 1/1.
Figure 5 | Multicast IPv4 Traffic over an IPv4 Unicast GRE Tunnel (De-encapsulation) |
![](/c/dam/en/us/td/i/200001-300000/270001-280000/271001-272000/271764.eps/_jcr_content/renditions/271764.jpg)
How to Configure NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces
- Sample Network
- Configuring a GRE IP Tunnel
- Verifying the Status of the GRE IP Tunnel
- Configuring NetFlow Accounting on a GRE IP Tunnel Interface
- Configuring NetFlow Accounting on the Physical Interfaces
- Verifying NetFlow Accounting
- Configuring NetFlow Data Export Using the Version 9 Export Format
- Verifying That NetFlow Data Export Is Operational
Sample Network
The tasks in this section use the sample network shown in the figure below.
Figure 6 | Sample Network with a GRE IPv4 Tunnel |
![](/c/dam/en/us/td/i/200001-300000/270001-280000/271001-272000/271765.eps/_jcr_content/renditions/271765.jpg)
Configuring a GRE IP Tunnel
To configure a GRE IP tunnel as shown in Configuring a GRE IP Tunnel, perform the task in this section.
Ensure that the physical interface to be used as the tunnel source in this task is up and configured with the appropriate IP address. For hardware technical descriptions and information about installing interfaces, see the hardware installation and configuration documentation for your product.
![]() Note |
GRE tunnel keepalive is not supported in cases where virtual route forwarding (VRF) is applied to a GRE tunnel. |
DETAILED STEPS
Command or Action | Purpose | |||||
---|---|---|---|---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode. |
||||
|
Example: Router# configure terminal |
Enters global configuration mode. |
||||
|
Example: Router(config)# interface tunnel 0 |
Specifies the interface type and number and enters interface configuration mode. |
||||
|
Example: Router(config-if)# bandwidth 1000 |
Sets the current bandwidth value for an interface and communicates it to higher-level protocols. Specifies the tunnel bandwidth to be used to transmit packets.
|
||||
|
Example: Router(config-if)# ip address 192.168.3.1 255.255.255.0 |
Specifies an IP address for the interface. |
||||
|
Example: Router(config-if)# keepalive 3 7 |
(Optional) Specifies the number of times that the device will continue to send keepalive packets without response before bringing the tunnel interface protocol down.
|
||||
|
Example: Router(config-if)# tunnel source GigabitEthernet6/2 |
Configures the tunnel source.
|
||||
|
Example: Router(config-if)# tunnel destination 10.5.9.62 |
Configures the tunnel destination.
|
||||
|
Example: Router(config-if)# tunnel key 1000 |
(Optional) Enables an ID key for a tunnel interface.
|
||||
|
Example: Router(config-if)# tunnel mode gre ip |
Specifies GRE IP as the encapsulation protocol to be used in the tunnel. |
||||
|
Example: Router(config-if)# ip mtu 1400 |
(Optional) Set the maximum transmission unit (MTU) size of IP packets sent on an interface.
|
||||
|
Example: Router(config-if)# ip tcp mss 250 |
(Optional) Specifies the maximum segment size (MSS) for TCP connections that originate or terminate on a router. |
||||
|
Example: Router(config-if)# tunnel path-mtu-discovery |
(Optional) Enables Path MTU Discovery (PMTUD) on a GRE or IP-in-IP tunnel interface. |
||||
|
Example: Router(config-if)# end |
Exits interface configuration mode and returns to privileged EXEC mode. |
||||
|
|
-- |
Verifying the Status of the GRE IP Tunnel
To verify the tunnel configuration and operation, perform the following optional task:
DETAILED STEPS
Step 1 | enable Enables privileged EXEC mode. Enter your password if prompted. Example:
Router> enable
|
Step 2 | ping ip-address To verify that each router has IP connectivity to the tunnel endpoint on the other router, ping the IP address of the remote tunnel endpoint from the local router. Example: c65002# ping 192.168.3.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.3.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 20/20/20 ms |
Step 3 | ping ip-address To verify that each router has IP connectivity to the tunnel endpoint on the other router, ping the IP address of the remote tunnel endpoint from the local router. Example: c65003# ping 192.168.3.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds: !!!!! |
Step 4 | show interfaces tunnel number [accounting Displays the status and statistics of the tunnel interface Example:
c65002# show interface tunnel 0
Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 192.168.3.1/24
MTU 1514 bytes, BW 1000 Kbit, DLY 50000 usec,
reliability 255/255, txload 115/255, rxload 57/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 10.4.9.62 (GigabitEthernet6/2), destination 10.5.9.62
Tunnel protocol/transport GRE/IP
Key disabled, sequencing disabled
Checksumming of packets disabled
Tunnel TTL 255, Fast tunneling enabled
Path MTU Discovery, ager 10 mins, min MTU 92
Last input 00:07:35, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 4139000 bits/sec, 659 packets/sec
5 minute output rate 4117000 bits/sec, 669 packets/sec
L2 Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes
L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast
L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes
245049 packets input, 192533770 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
251500 packets output, 196216398 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
|
Configuring NetFlow Accounting on a GRE IP Tunnel Interface
To configure NetFlow on a GRE IP tunnel interface, perform the following task:
DETAILED STEPS
Configuring NetFlow Accounting on the Physical Interfaces
To configure NetFlow accounting on one or more physical interfaces, perform the following task:
- ip flow {ingress | egress}
DETAILED STEPS
Verifying NetFlow Accounting
To verify that NetFlow accounting for the tunnel interface is working, perform the following task.
![]() Note |
This task uses the sample network shown in the figure below. |
DETAILED STEPS
Step 1 | enable Enables privileged EXEC mode. Enter your password if prompted. Example:
Router> enable
|
Step 2 | show ip cache flow The show ip cache flow command displays the NetFlow statistics in the cache. The tunnel interface (Tu0) appears in several rows of the statistics, indicating that NetFlow accounting is operational for the tunnel interface. Example:
c65003# show ip cache flow
-------------------------------------------------------------------------------
Displaying software-switched flow entries on the MSFC in Module 5:
IP packet size distribution (3721891 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 1.00 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes
2 active, 4094 inactive, 6 added
5394 ager polls, 0 flow alloc failures
Active flows timeout in 30 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 33992 bytes
0 active, 1024 inactive, 0 added, 0 added to flow
0 alloc failures, 0 force free
1 chunk, 0 chunks added
last clearing of statistics 05:58:56
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
ICMP 4 0.0 406293 1499 75.4 626.5 12.3
Total: 4 0.0 406293 1499 75.4 626.5 12.3
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Fa3/1 192.168.22.2 Tu0* 192.168.10.2 01 0000 0000 1052K
Fa3/1 192.168.22.2 Tu0 192.168.10.2 01 0000 0000 1052K
-------------------------------------------------------------------------------
Displaying hardware-switched flow entries in the PFC (Active) Module 5:
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Tu0 10.4.9.62 Gi6/2 10.5.9.62 2F 0000 0000 155K
-- 0.0.0.0 --- 0.0.0.0 00 0000 0000 1764K
Fa3/1 192.168.22.2 Tu0 192.168.10.2 01 0000 0000 65K
Tu0 192.168.10.2 Fa3/1 192.168.22.2 01 0000 0000 695K
Tu0 192.168.10.2 Fa3/1 192.168.22.2 01 0008 0000 66K
Tu0 192.168.10.2 Fa3/1 192.168.22.2 11 F378 F566 90K
Fa3/1 192.168.22.2 Tu0 192.168.10.2 11 F566 F378 90K
|
Step 3 | show mls net ip module number The show mls net ip mod number command displays information about the hardware-switched NetFlow flows. The tunnel interface (Tu0) appears in several rows of the statistics, indicating that NetFlow accounting is operational for the tunnel interface. Example:
c65003# show mls net ip module 5
Displaying NetFlow entries in Active Supervisor EARL in module 5
DstIP SrcIP Prot:SrcPort:DstPort Src i/f :AdjPtr
-----------------------------------------------------------------------------
Pkts Bytes Age LastSeen Attributes
---------------------------------------------------
224.0.0.2 10.4.9.254 udp :646 :646 Gi6/2 :0x0
46 2852 200 00:30:28 Multicast
0.0.0.0 0.0.0.0 0 :0 :0 -- :0x0
238 17450 203 00:30:28 L3 - Dynamic
224.0.0.13 172.31.0.2 103 :0 :0 Gi6/2 :0x0
7 378 189 00:30:21 Multicast
224.0.0.5 192.168.255.254 89 :0 :0 Fa3/1 :0x0
204 16320 204 00:30:31 Multicast
224.0.0.1 172.31.0.2 2 :0 :0 Gi6/2 :0x0
3 138 174 00:29:38 Multicast
10.4.9.255 10.4.9.2 udp :138 :138 Fa3/1 :0x0
0 0 143 00:28:09 L3 - Dynamic
224.0.0.13 192.168.3.2 103 :0 :0 Tu0 :0x0
6 372 153 00:30:28 Multicast
224.192.16.1 172.31.0.1 icmp:0 :0 Fa3/1 :0x0
20435 940010 205 00:30:32 Multicast
224.0.0.1 192.168.3.2 2 :0 :0 Tu0 :0x0
2 64 103 00:29:49 Multicast
10.4.9.255 10.4.9.2 udp :137 :137 Fa3/1 :0x0
0 0 79 00:30:10 L3 - Dynamic |
Configuring NetFlow Data Export Using the Version 9 Export Format
To configure NetFlow Data Export using the Version 9 data export format, perform the following task:
DETAILED STEPS
Command or Action | Purpose | |||
---|---|---|---|---|
|
Example: Router> enable |
Enters privileged EXEC mode.
|
||
|
Example: Router# configure terminal |
Enters global configuration mode. |
||
|
Example: Router(conf)# mls flow ip interface-full |
Specifies the flow mask for NetFlow data export. |
||
|
Example: Router(config)# mls nde sender |
Enables multi-layer switching (MLS) NetFlow data export (NDE). |
||
|
Example: Router(config)# ip flow-export destination 172.16.10.2 99 |
Specifies the IP address or hostname of the NetFlow collector and the UDP port on which the NetFlow collector is listening. |
||
|
|
(Optional) You can configure a maximum of two export destinations for NetFlow. |
||
|
Example: Router(config)# ip flow-export source gigabitethernet 6/2 |
(Optional) Specifies the interface from which the source IP address is derived for the UDP datagrams that are sent by NetFlow data export to the destination host. |
||
|
Example: Router(config)# ip flow-export version 9 |
(Optional) Enables the export of information in NetFlow cache entries.
|
||
|
Example: Router(config)# ip flow-export template refresh-rate 15 Example:
|
(Optional) Enables the export of information in NetFlow cache entries.
|
||
|
Example: Router(config)# ip flow-export template timeout-rate 90 |
(Optional) Enables the export of information in NetFlow cache entries.
|
||
|
Example: Router(config)# ip flow-export template options export-stats |
(Optional) Enables the export of information in NetFlow cache entries.
|
||
|
Example: Router(config)# ip flow-export template options refresh-rate 25 |
(Optional) Enables the export of information in NetFlow cache entries.
|
||
|
Example: Router(config)# ip flow-export template options timeout-rate 120 |
(Optional) Enables the export of information in NetFlow cache entries.
|
||
|
Example: Router(config)# end |
Exits the current configuration mode and returns to privileged EXEC mode. |
Verifying That NetFlow Data Export Is Operational
To verify that NetFlow data export is operational, perform the following optional task.
DETAILED STEPS
Step 1 | show ip flow export Use this command to display the statistics for the NetFlow data export, including statistics for the main cache and for all other enabled caches. The following is sample output from this command: Example:
Router# show ip flow export
Flow export v9 is enabled for main cache
Export source and destination details :
VRF ID : Default
Source(1) 10.4.9.62 (GigabitEthernet6/2)
Source(2) 10.4.9.62 (GigabitEthernet6/2)
Destination(1) 172.16.10.2 (99)
Destination(2) 172.16.10.3 (99)
Version 9 flow records
11 flows exported in 11 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level
0 export packets were dropped due to no fib
0 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
0 export packets were dropped enqueuing for the RP
0 export packets were dropped due to IPC rate limiting
0 export packets were dropped due to Card not being able to export
|
Step 2 | show ip flow export template Use this command to display the statistics for the NetFlow data export (such as the template timeout rate and the refresh rate) for the template-specific configurations. The following is sample output from this command: Example:
Router# show ip flow export template
Template Options Flag = 1
Total number of Templates added = 1
Total active Templates = 1
Flow Templates active = 0
Flow Templates added = 0
Option Templates active = 1
Option Templates added = 1
Template ager polls = 0
Option Template ager polls = 388
Main cache version 9 export is enabled
Template export information
Template timeout = 90
Template refresh rate = 15
Option export information
Option timeout = 120
Option refresh rate = 25 |
Configuration Examples for NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces
Configuring a GRE IP Tunnel Example
The following example shows how to configure a GRE IP tunnel:
interface Tunnel0 tunnel mode gre ip bandwidth 1000 ip address 192.168.3.1 255.255.255.0 tunnel source GigabitEthernet6/2 tunnel destination 10.5.9.62 tunnel path-mtu-discovery
The following display output shows that the GRE IP tunnel is operational because the tunnel is transmitting and receiving traffic:
c65002# show interface tunnel 0
Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 192.168.3.1/24
MTU 1514 bytes, BW 1000 Kbit, DLY 50000 usec,
reliability 255/255, txload 90/255, rxload 98/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 10.4.9.62 (GigabitEthernet6/2), destination 10.5.9.62
Tunnel protocol/transport GRE/IP
Key disabled, sequencing disabled
Checksumming of packets disabled
Tunnel TTL 255, Fast tunneling enabled
Path MTU Discovery, ager 10 mins, min MTU 92
Last input 00:11:44, output 00:11:44, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 380000 bits/sec, 125 packets/sec
5 minute output rate 347000 bits/sec, 125 packets/sec
L2 Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes
L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast
L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes
3344121 packets input, 2452613051 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
3399211 packets output, 2431569783 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
Configuring NetFlow Accounting on a GRE IP Tunnel Example
The following example shows how to configure NetFlow Accounting on a GRE IP Tunnel and a FastEthernet interface:
mls flow ip interface-full interface tunnel 0 ip flow egress ip flow ingress interface FastEthernet3/1 no shut ip address 192.168.22.1 255.255.255.0 ip flow ingress ip flow egress
The following display output shows that NetFlow accounting is operational because the flow cache has NetFlow statistics data in it:
c65002# show ip cache flow
-------------------------------------------------------------------------------
Displaying software-switched flow entries on the MSFC in Module 5:
IP packet size distribution (3721891 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 1.00 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes
2 active, 4094 inactive, 6 added
5394 ager polls, 0 flow alloc failures
Active flows timeout in 30 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 33992 bytes
0 active, 1024 inactive, 0 added, 0 added to flow
0 alloc failures, 0 force free
1 chunk, 0 chunks added
last clearing of statistics 05:58:56
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
ICMP 4 0.0 406293 1499 75.4 626.5 12.3
Total: 4 0.0 406293 1499 75.4 626.5 12.3
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Fa3/1 192.168.22.2 Tu0* 192.168.10.2 01 0000 0000 1052K
Fa3/1 192.168.22.2 Tu0 192.168.10.2 01 0000 0000 1052K
-------------------------------------------------------------------------------
Displaying hardware-switched flow entries in the PFC (Active) Module 5:
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Tu0 10.4.9.62 Gi6/2 10.5.9.62 2F 0000 0000 155K
-- 0.0.0.0 --- 0.0.0.0 00 0000 0000 1764K
Fa3/1 192.168.22.2 Tu0 192.168.10.2 01 0000 0000 65K
Tu0 192.168.10.2 Fa3/1 192.168.22.2 01 0000 0000 695K
Tu0 192.168.10.2 Fa3/1 192.168.22.2 01 0008 0000 66K
Tu0 192.168.10.2 Fa3/1 192.168.22.2 11 F378 F566 90K
Fa3/1 192.168.22.2 Tu0 192.168.10.2 11 F566 F378 90K
The following display output shows that NetFlow accounting is operational because there are statistics for the hardware-switched NetFlow flows.
c65003# show mls net ip mod 5
Displaying NetFlow entries in Active Supervisor EARL in module 5
DstIP SrcIP Prot:SrcPort:DstPort Src i/f :AdjPtr
-----------------------------------------------------------------------------
Pkts Bytes Age LastSeen Attributes
---------------------------------------------------
224.0.0.2 10.4.9.254 udp :646 :646 Gi6/2 :0x0
46 2852 200 00:30:28 Multicast
0.0.0.0 0.0.0.0 0 :0 :0 -- :0x0
238 17450 203 00:30:28 L3 - Dynamic
224.0.0.13 172.31.0.2 103 :0 :0 Gi6/2 :0x0
7 378 189 00:30:21 Multicast
224.0.0.5 192.168.255.254 89 :0 :0 Fa3/1 :0x0
204 16320 204 00:30:31 Multicast
224.0.0.1 172.31.0.2 2 :0 :0 Gi6/2 :0x0
3 138 174 00:29:38 Multicast
10.4.9.255 10.4.9.2 udp :138 :138 Fa3/1 :0x0
0 0 143 00:28:09 L3 - Dynamic
224.0.0.13 192.168.3.2 103 :0 :0 Tu0 :0x0
6 372 153 00:30:28 Multicast
224.192.16.1 172.31.0.1 icmp:0 :0 Fa3/1 :0x0
20435 940010 205 00:30:32 Multicast
224.0.0.1 192.168.3.2 2 :0 :0 Tu0 :0x0
2 64 103 00:29:49 Multicast
10.4.9.255 10.4.9.2 udp :137 :137 Fa3/1 :0x0
0 0 79 00:30:10 L3 - Dynamic
Additional References
Related Documents
Related Topic |
Document Title |
---|---|
Configuring Cisco IOS 12.2SX on Cisco Catalyst 6500 series switches |
Catalyst 6500 Release 12.2SXH and Later Software Configuration Guide |
Standards
Standard |
Title |
---|---|
There are no standards associated with this feature. |
-- |
MIBs
MIB |
MIBs Link |
---|---|
There are no MIBs associated with this feature. |
-- |
RFCs
RFC |
Title |
---|---|
RFC 2784 |
Technical Assistance
Description |
Link |
---|---|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
Feature Information for Configuring NetFlow Accounting for Unicast and Multicast on GRE IP Tunnel Interfaces
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 3 | Feature Information for Flexible NetFlow |
Feature Name |
Releases |
Feature Configuration Information |
---|---|---|
Configuring NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces |
12.2(33)SXI |
The Configuring NetFlow Accounting for Unicast and Multicast on GRE Tunnel Interfaces feature allows NetFlow statistics to be gathered on traffic that is transmitted over a GRE IP tunnel interface. The following section provides information for configuring this feature: No commands were introduced or modified for this feature. |
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.