4.2 Configure and verify Flexible NetFlow

Flexible NetFlow answers a question packet captures do not answer well at scale: what traffic is using the network?

A packet capture is deep. NetFlow is wide. It summarizes conversations so you can see top talkers, applications, source and destination networks, direction, packet counts, and byte counts.

The four pieces

Flexible NetFlow is easier when you remember the four parts:

Record = what fields define and describe a flow
Exporter = where to send the flow records
Monitor = record + exporter + cache behavior
Interface = where the monitor is applied

If you miss the interface attachment, nothing is being watched.

Traffic on Gi0/0/0 ingress -> Flow monitor · cache and timeout -> Flow record · match keys -> Flow exporter · UDP/2055 -> NMS collector

Add one more operational word: observation point. A flow record is true for the interface and direction where the monitor is applied. A flow seen inbound on a user SVI is not the same evidence as a flow seen outbound on a WAN interface after NAT, policy, or routing changed the packet.

What is a flow?

A flow is a conversation described by key fields. A typical IPv4 flow is identified by:

• Source IP address.
• Destination IP address.
• Source transport port.
• Destination transport port.
• Layer 3 protocol.
• Input interface.
• DSCP or type of service, depending on record design.

match fields define uniqueness. collect fields add extra information to the exported record.

Basic configuration

This example exports IPv4 flow data to a collector at 10.10.10.50 using UDP port 2055.

conf t
!
flow record CCNP-FNF-RECORD
description IPv4 source/destination/port flow record
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface input
collect counter bytes long
collect counter packets long
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
flow exporter CCNP-FNF-EXPORTER
description Export flows to NMS collector
destination 10.10.10.50
source Loopback0
transport udp 2055
export-protocol netflow-v9
template data timeout 60
!
flow monitor CCNP-FNF-MONITOR
description Monitor IPv4 traffic for ENCOR lab
record CCNP-FNF-RECORD
exporter CCNP-FNF-EXPORTER
cache timeout active 60
cache timeout inactive 15
!
interface GigabitEthernet1/0/1
 description User VLAN uplink
 ip flow monitor CCNP-FNF-MONITOR input
 end

The interface line is where monitoring begins. Without it, the configuration exists but observes nothing.

Direction matters

NetFlow is normally applied in a direction.

interface GigabitEthernet1/0/1
 ip flow monitor CCNP-FNF-MONITOR input

input means packets entering that interface. Do not blindly apply monitors everywhere. You can double count traffic or create confusing reports. Know where the traffic enters the device and monitor there.

Verify the configuration

Check each object.

show flow record CCNP-FNF-RECORD
show flow exporter CCNP-FNF-EXPORTER
show flow monitor CCNP-FNF-MONITOR

Check the interface.

show running-config interface GigabitEthernet1/0/1

Check the live cache.

show flow monitor CCNP-FNF-MONITOR cache

Example output shape:

Cache type: Normal
Cache size: 4096
Current entries: 12
IPV4 SRC ADDR IPV4 DST ADDR TRNS SRC PORT TRNS DST PORT bytes pkts
10.10.10.10 10.10.20.20 51544 443 18492 31
10.10.10.22 8.8.8.8 53119 53 182 2

Check exporter statistics.

show flow exporter CCNP-FNF-EXPORTER statistics

If the cache shows flows but the collector sees nothing, investigate exporter reachability, source interface, UDP port, collector firewall, NetFlow version, and template handling.

Separate cache evidence from export evidence. A populated cache proves the device is observing matching traffic. Exporter statistics prove the device is attempting to send records. A silent collector can still be a collector, template, firewall, routing, VRF, or UDP-port problem.

For NetFlow v9/IPFIX, remember that collectors need templates before they can decode records. A short capture that only sees data records without templates can look broken even when the exporter is functioning.

Common mistakes

Record exists, monitor does not

A record is only a definition.

Monitor exists, interface attachment is missing

This is the most common lab mistake. Always check the interface.

Wrong direction

If traffic enters another interface, your cache may stay empty.

Exporter source is unreachable

Use a stable source interface, usually a loopback, and make sure the collector can reach it.

Expecting packet payloads

NetFlow is metadata. Use SPAN, RSPAN, or ERSPAN when you need packet contents.

Lab: Export user traffic flows

Topology

PC1 -> SW1 -> R1 -> Server | Collector 10.10.10.50

Goal

Export flow data for user traffic entering SW1 interface Gi1/0/1.

Tasks

1. Create a flow record matching IPv4 conversations.
2. Export to 10.10.10.50 using Loopback0 as the source.
3. Create a flow monitor using the record and exporter.
4. Apply the monitor inbound on the user-facing interface.
5. Generate traffic from PC1 to the server.
6. Verify flows locally and exporter statistics.

Configuration

conf t
interface Loopback0
 ip address 10.255.255.1 255.255.255.255
!
flow record USER-IPV4
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface input
collect counter bytes long
collect counter packets long
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
flow exporter TO-COLLECTOR
destination 10.10.10.50
source Loopback0
transport udp 2055
export-protocol netflow-v9
!
flow monitor USER-MONITOR
record USER-IPV4
exporter TO-COLLECTOR
cache timeout active 60
cache timeout inactive 15
!
interface GigabitEthernet1/0/1
 ip flow monitor USER-MONITOR input
 end

Verification

show flow monitor USER-MONITOR cache
show flow exporter TO-COLLECTOR statistics
show running-config interface GigabitEthernet1/0/1

Expected lesson

The exam will often test the relationship between record, exporter, monitor, and interface. If you can draw those four boxes, most NetFlow configuration questions become straightforward.

Exam takeaways

• Flexible NetFlow uses record, exporter, monitor, and interface attachment.
• match fields define flow uniqueness; collect fields add data.
• Apply the monitor to the correct interface and direction.
• Use show flow monitor ... cache for local verification.
• NetFlow shows traffic metadata, not packet payloads.