4.2 Configure and verify Flexible NetFlow

What this objective tests

Flexible NetFlow (FNF) answers a question packet captures answer badly at scale: what traffic is using the network? When flow records are not enough and you need the packets themselves, mirror them with SPAN, RSPAN, or ERSPAN. The exam tests the four building blocks and how they connect. You must configure a full working setup and read the flow cache.

The four pieces

Record   = which fields define and describe a flow
Exporter = where to send the flow records
Monitor  = record + exporter + cache behavior
Interface = where the monitor is applied

If you miss the interface attachment, nothing is watched. This is the most common lab mistake.

Traffic in on Gi1/0/1 -> flow monitor (cache) -> flow record (match keys) -> flow exporter (UDP 2055) -> collector

What is a flow?

A flow is a conversation described by key fields. A typical IPv4 flow key contains:

• Source IP address.
• Destination IP address.
• Source transport port.
• Destination transport port.
• Layer 3 protocol.
• Input interface.

match fields define flow uniqueness. collect fields add extra data to the exported record, such as byte counters and timestamps.

Example: export user flows to a collector

Scenario: users on VLAN 10 connect through GigabitEthernet1/0/1. Export IPv4 flow data to the collector at 10.10.10.50 on UDP port 2055. Use Loopback0 (10.255.255.1) as the exporter source.

Step 1: create the flow record

flow record CCNP-FNF-RECORD
 description IPv4 source/destination/port flow record
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match ipv4 protocol
 match interface input
 collect counter bytes long
 collect counter packets long
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last

Step 2: create the flow exporter

flow exporter CCNP-FNF-EXPORTER
 description Export flows to NMS collector
 destination 10.10.10.50
 source Loopback0
 transport udp 2055
 export-protocol netflow-v9
 template data timeout 60

Step 3: create the flow monitor

flow monitor CCNP-FNF-MONITOR
 description Monitor IPv4 user traffic
 record CCNP-FNF-RECORD
 exporter CCNP-FNF-EXPORTER
 cache timeout active 60
 cache timeout inactive 15

Step 4: apply the monitor to the interface

interface GigabitEthernet1/0/1
 description User VLAN uplink
 ip flow monitor CCNP-FNF-MONITOR input

input means packets that enter the interface. Monitor where the traffic enters the device. Applying monitors in both directions on many interfaces can double-count traffic.

Verify the configuration

Check each object, then the live cache:

show flow record CCNP-FNF-RECORD
show flow exporter CCNP-FNF-EXPORTER
show flow monitor CCNP-FNF-MONITOR
show running-config interface GigabitEthernet1/0/1
show flow monitor CCNP-FNF-MONITOR cache

Expected cache output after PC 10.10.10.10 browses to a server:

Cache type:                               Normal
  Cache size:                               4096
  Current entries:                             2

IPV4 SRC ADDR    IPV4 DST ADDR    TRNS SRC PORT  TRNS DST PORT  intf input        bytes long  pkts long
10.10.10.10      10.10.20.20             51544            443   Gi1/0/1                18492        31
10.10.10.22      8.8.8.8                 53119             53   Gi1/0/1                  182         2

Check the exporter statistics:

show flow exporter CCNP-FNF-EXPORTER statistics

Separate cache evidence from export evidence. A populated cache proves the device observes traffic. Exporter statistics prove the device sends records. If the cache has flows but the collector is silent, check exporter reachability, source interface, UDP port, collector firewall, and NetFlow version.

Note: NetFlow v9 collectors need templates before they can decode records. A collector that sees data records without templates can look broken even when the exporter works.

Lab: export user traffic flows

Topology:

PC1 10.10.10.10 -- Gi1/0/1 [SW1] -- server 10.10.20.20
                        |
                   Loopback0 10.255.255.1
                        |
                   collector 10.10.10.50 (UDP 2055)

Goal: export flow data for user traffic entering Gi1/0/1 and verify it in the local cache.

Do these steps:

1. Configure Loopback0 with 10.255.255.1/32.
2. Create the flow record USER-IPV4 with the six match fields and four collect fields from the example above.
3. Create the flow exporter TO-COLLECTOR with destination 10.10.10.50, source Loopback0, transport udp 2055, and netflow-v9.
4. Create the flow monitor USER-MONITOR that uses the record and exporter. Set active timeout 60 and inactive timeout 15.
5. Apply the monitor inbound on GigabitEthernet1/0/1: ip flow monitor USER-MONITOR input.
6. Generate traffic from PC1 to the server. Ping, browse, and do a DNS lookup.
7. Verify with show flow monitor USER-MONITOR cache.

Full device configuration:

conf t
interface Loopback0
 ip address 10.255.255.1 255.255.255.255
!
flow record USER-IPV4
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match ipv4 protocol
 match interface input
 collect counter bytes long
 collect counter packets long
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
!
flow exporter TO-COLLECTOR
 destination 10.10.10.50
 source Loopback0
 transport udp 2055
 export-protocol netflow-v9
!
flow monitor USER-MONITOR
 record USER-IPV4
 exporter TO-COLLECTOR
 cache timeout active 60
 cache timeout inactive 15
!
interface GigabitEthernet1/0/1
 ip flow monitor USER-MONITOR input
end

Expected result: show flow monitor USER-MONITOR cache lists entries with PC1 source addresses, server destination addresses, and increasing byte counters. show flow exporter TO-COLLECTOR statistics shows sent records.

Exam traps

• A record alone observes nothing. The chain is record + exporter + monitor + interface.
• The most common mistake: the monitor is never applied to the interface. Always check show running-config interface.
• Wrong direction means an empty cache. If traffic enters another interface, input on this interface sees nothing.
• NetFlow is metadata: addresses, ports, counters. Use SPAN, RSPAN, or ERSPAN when you need packet payloads.
• Use a loopback as the exporter source and make sure the collector can route to it.

Pass check

You are ready when you can do these things:

• Draw the four FNF pieces and explain what each one does.
• Configure a record, exporter, monitor, and interface attachment from scratch.
• Read show flow monitor ... cache and name the flow key fields.
• Explain the difference between cache evidence and export evidence.