Flexible NetFlow: Complete CCNP ENCOR Guide

Why Flexible NetFlow is Important

Flexible NetFlow (FNF) has become critical in modern network management for several reasons:

• Traffic Visibility: Provides detailed insight into network traffic patterns, helping identify bandwidth-heavy applications and users.
• Security Monitoring: Detects anomalous traffic flows that might indicate security threats, DDoS attacks, or unauthorized access.
• Performance Troubleshooting: Enables network engineers to pinpoint congestion points and performance bottlenecks quickly.
• Capacity Planning: Delivers historical traffic data essential for making informed decisions about network expansion.
• Compliance and Billing: Tracks application and user-based traffic for accounting, chargeback, and regulatory compliance purposes.
• QoS Optimization: Identifies application flows to help prioritize critical traffic and optimize Quality of Service policies.

What is Flexible NetFlow?

Flexible NetFlow (FNF) is an advanced traffic flow monitoring technology developed by Cisco that extends the capabilities of traditional NetFlow. It allows network administrators to define which traffic fields are monitored and how flow data is exported, providing granular control over network traffic analysis.

Key Differences from Traditional NetFlow:

• Customization: FNF allows you to select specific fields to monitor, rather than being limited to predefined flow records.
• Multiple Flow Records: Supports various built-in flow record formats tailored to specific monitoring needs (IPv4, IPv6, application-based, etc.).
• Flexible Exporters: Enables configuration of multiple exporters with different destinations and parameters.
• Advanced Filtering: Provides capabilities to filter flows before collection, reducing overhead.

How Flexible NetFlow Works

Core Components:

1. Flow Monitor: Collects flow information based on defined key fields and collects statistics. It's the engine that gathers traffic data.
2. Flow Record: Defines which fields are captured and their purpose (key field or data field). Think of it as a template for what data to collect.
3. Flow Exporter: Sends collected flow data to a remote server (NetFlow Collector) in a specified format. This is the delivery mechanism for flow data.
4. Flow Sampler: Optionally samples traffic to reduce processor overhead. Useful on high-traffic interfaces.

The FNF Process Flow:

1. Traffic enters an interface with FNF enabled.
2. The flow monitor examines packets based on configured key fields (source IP, destination IP, protocol, ports, etc.).
3. If a matching flow exists, statistics are updated; if not, a new flow is created.
4. Flows age out based on timeout values (active and inactive timeouts).
5. When a flow is complete or times out, the exporter sends the flow data to the configured collector.
6. The NetFlow collector receives and processes the flow records for analysis and reporting.

Key Terminology

• Key Field: Traffic characteristics used to identify unique flows (e.g., source IP, destination IP, protocol, source port, destination port). All packets matching the same key fields belong to the same flow.
• Data Field: Metrics collected for each flow (e.g., byte count, packet count, duration, TCP flags). Used for statistics but don't define flow identity.
• Active Timeout: Duration after which an active flow expires and is exported (default: 30 minutes in FNF).
• Inactive Timeout: Duration of inactivity before a flow is considered complete and exported (default: 15 seconds in FNF).
• Flow Cache: Memory area storing active flows being monitored.

Flexible NetFlow Configuration

Step-by-Step Configuration:

Step 1: Define a Flow Record

Router(config)# flow record MY_FLOW_RECORD
Router(config-flow-record)# description Custom flow record
Router(config-flow-record)# match ipv4 source address
Router(config-flow-record)# match ipv4 destination address
Router(config-flow-record)# match transport source-port
Router(config-flow-record)# match transport destination-port
Router(config-flow-record)# match transport protocol
Router(config-flow-record)# collect counter bytes
Router(config-flow-record)# collect counter packets
Router(config-flow-record)# collect timestamp sys-uptime first
Router(config-flow-record)# collect timestamp sys-uptime last

Step 2: Define a Flow Monitor

Router(config)# flow monitor MY_FLOW_MONITOR
Router(config-flow-monitor)# description Custom flow monitor
Router(config-flow-monitor)# record MY_FLOW_RECORD
Router(config-flow-monitor)# cache timeout active 60
Router(config-flow-monitor)# cache timeout inactive 30

Step 3: Define a Flow Exporter

Router(config)# flow exporter MY_EXPORTER
Router(config-flow-exporter)# description Export to NetFlow collector
Router(config-flow-exporter)# destination 192.168.1.100
Router(config-flow-exporter)# source Loopback0
Router(config-flow-exporter)# transport udp 2055
Router(config-flow-exporter)# template data timeout 600
Router(config-flow-exporter)# option interface-table timeout 300

Step 4: Apply to Interface

Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# ip flow monitor MY_FLOW_MONITOR input
Router(config-if)# ip flow monitor MY_FLOW_MONITOR output

Alternative: Using Built-in Records

Cisco provides pre-configured flow records for common use cases:

Router(config)# flow monitor NETFLOW_ORIGINAL
Router(config-flow-monitor)# record netflow ipv4 original-input

Flexible NetFlow Verification

Essential Verification Commands:

1. Verify Flow Monitor Status

Router# show flow monitor MY_FLOW_MONITOR
Router# show flow monitor MY_FLOW_MONITOR cache

Output shows: Active flows, inactive flows, cache size, timeouts configured.

2. Verify Flow Record Configuration

Router# show flow record MY_FLOW_RECORD

Output displays: Match fields (key fields), Collect fields (data fields), and descriptions.

3. Verify Flow Exporter Status

Router# show flow exporter MY_EXPORTER
Router# show flow exporter MY_EXPORTER statistics

Output shows: Destination IP, transport protocol, packets sent, templates sent, and connection status.

4. Verify Interface Configuration

Router# show ip flow interface GigabitEthernet0/0/0

Output confirms: Flow monitors applied (input/output), direction information.

5. Monitor Real-time Flows

Router# show flow monitor MY_FLOW_MONITOR cache sort bytes descending
Router# show flow monitor MY_FLOW_MONITOR cache filter match ipv4 source address 10.0.0.5

These commands show active flows sorted by bytes or filtered by specific criteria.

6. Check Exporter Statistics

Router# show flow exporter MY_EXPORTER statistics detail

Output provides: Templates sent, flow records sent, packets exported, reliability information.

7. Troubleshoot Configuration

Router# show running-config | include flow
Router# show flow record
Router# show flow monitor
Router# show flow exporter

Common Flexible NetFlow Configurations

Configuration 1: Monitor Application Traffic

flow record APP_MONITOR
 match application name
 match ipv4 source address
 match ipv4 destination address
 match transport protocol
 collect counter bytes long
 collect counter packets long
 collect application http host
 collect application http url

Configuration 2: Security Monitoring (DDoS Detection)

flow record SECURITY_MONITOR
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match transport protocol
 collect counter packets long
 collect counter bytes long
 collect transport tcp flags

Configuration 3: Multi-Protocol Monitoring

flow record IPV4_AND_IPV6
 match ipv4 source address
 match ipv6 source address
 match ipv4 destination address
 match ipv6 destination address
 match transport protocol
 collect counter bytes
 collect counter packets

Exam Tips: Answering Questions on Flexible NetFlow Configuration and Verification

Tip 1: Understand the Three-Layer Architecture

Remember that FNF configuration involves three distinct components that work together:

• Flow Record: Defines WHAT to capture (match and collect fields)
• Flow Monitor: Defines HOW to capture (cache settings, timeouts, which record to use)
• Flow Exporter: Defines WHERE to send data (destination, format, transport)

Exam questions often test whether you understand these layers. When you see a configuration scenario, identify which component needs modification.

Tip 2: Know the Configuration Sequence

Configuration must follow a logical order:

1. Define the flow record FIRST (templates must exist before monitors use them)
2. Create the flow monitor using the record (monitor references record)
3. Define the exporter if needed for NetFlow data export
4. Apply the monitor to interfaces LAST (apply to existing components)

Questions asking "What's the first command you'd configure?" test this ordering.

Tip 3: Master Match vs. Collect Commands

• Match commands: Create flow identity. Packets with identical match field values belong to the same flow. Examples: source IP, destination IP, protocol, ports.
• Collect commands: Gather statistics about flows. Don't affect flow identity. Examples: byte count, packet count, TCP flags, timestamps.

Exam scenarios often ask: "Which command defines unique flows?" Answer: match commands. "Which command gathers statistics?" Answer: collect commands.

Tip 4: Remember Key Timeout Values

Default timeouts are exam favorites:

• Active Timeout (FNF default): 30 minutes - flows are exported even if still active
• Inactive Timeout (FNF default): 15 seconds - flows with no traffic for this period are exported
• Traditional NetFlow: 30 minutes active, 15 seconds inactive (same)

Question example: "A flow monitor exports data every 30 minutes. What timeout was configured?" Answer: Active timeout.

Tip 5: Distinguish Between Input and Output Application

When applying a monitor to an interface:

• Input: Monitors traffic entering the interface
• Output: Monitors traffic leaving the interface

For comprehensive monitoring, apply monitors in both directions. Exam questions test understanding of directionality and why you might apply only one direction (e.g., monitoring only inbound traffic).

Tip 6: Recognize Built-in Flow Records

Cisco provides pre-configured records. Know these common ones:

• netflow ipv4 original-input: Standard IPv4 NetFlow v9 format, input direction
• netflow ipv4 original-output: Standard IPv4 NetFlow v9 format, output direction
• netflow ipv6 original-input: For IPv6 traffic
• netflow original: Automatically handles IPv4 and IPv6

Questions often ask: "Which built-in record would you use for basic IPv4 monitoring?" Answer: netflow ipv4 original-input or netflow ipv4 original-output depending on direction.

Tip 7: Know Verification Command Output Interpretation

Exam questions require interpreting command outputs:

• show flow monitor cache: Shows active flows with their statistics. Look for: flow count, byte totals, packet counts, idle state.
• show flow exporter statistics: Shows export health. Look for: packets sent, templates sent, connection status, reliability information.
• show flow record: Shows template definition. Verify correct match/collect fields are configured.

Practice reading these outputs to quickly identify issues (e.g., "Why is exporter showing zero packets sent?" - likely destination unreachable).

Tip 8: Troubleshoot Common Issues

Exam questions often present troubleshooting scenarios:

• Issue: No flows appearing in cache
  Solutions: Verify monitor is applied to correct interface, check if traffic matches expected flows, ensure interface has traffic.
• Issue: Exporter not sending data
  Solutions: Verify destination IP reachability, confirm transport protocol/port, check for ACLs blocking export traffic, ensure source IP is routable.
• Issue: Too many flows in cache
  Solutions: Increase inactive timeout, reduce match field granularity, apply sampling, optimize flow record definition.
• Issue: High router CPU utilization
  Solutions: Implement flow sampling, reduce cache size, increase timeout values, use less granular match fields.

Tip 9: Understand Sampling and Its Purpose

FNF supports optional sampling to reduce overhead:

Router(config)# sampler MY_SAMPLER
Router(config-sampler)# mode deterministic 1 out-of 100

This samples 1 out of every 100 packets. Sampling:

• Reduces CPU and memory utilization
• Reduces export traffic to collector
• Reduces accuracy (but estimates are multiplied by sample rate)

Exam tip: If a question mentions high CPU usage from NetFlow, sampling is a potential solution.

Tip 10: Know the Complete Configuration Example

Be able to write a complete, correct FNF configuration from scratch. Practice this template:

! Define Record
flow record MY_RECORD
 match ipv4 source address
 match ipv4 destination address
 match transport protocol
 match transport source-port
 match transport destination-port
 collect counter bytes
 collect counter packets
!
! Define Monitor
flow monitor MY_MONITOR
 description Monitors application traffic
 record MY_RECORD
 cache timeout inactive 20
!
! Define Exporter
flow exporter MY_EXPORTER
 destination 10.1.1.100
 source Loopback0
 transport udp 2055
!
! Associate Exporter with Monitor
flow monitor MY_MONITOR
 exporter MY_EXPORTER
!
! Apply to Interface
interface GigabitEthernet0/0/1
 ip flow monitor MY_MONITOR input
 ip flow monitor MY_MONITOR output

Being comfortable with this structure ensures you can answer configuration questions confidently.

Tip 11: Pay Attention to Question Wording

• "Which command creates flow identity?" - Answer with match commands
• "Which command exports data to a collector?" - Answer with exporter configuration
• "Which timeout expires flows even if still active?" - Answer: Active timeout
• "How would you monitor only traffic going out an interface?" - Answer: Apply monitor with output keyword
• "Which component defines what fields to capture?" - Answer: Flow record

Tip 12: Understand Exporter Features

Exporters have several important options:

• Destination: IP address of NetFlow collector (REQUIRED)
• Source: Source IP address of export packets (RECOMMENDED - use loopback for reliability)
• Transport: Protocol and port (UDP 2055 is default, but TCP is also supported)
• Template Data Timeout: How often templates are re-sent to collector (important for collector synchronization)
• Option Interface-Table Timeout: Interval for sending interface information to collector

Questions might ask: "Why would you configure the source to use Loopback0?" Answer: To ensure export traffic uses a stable, reachable IP address even if an interface goes down.

Tip 13: Practice with Multi-Monitor Scenarios

Advanced exam questions may involve multiple monitors:

• Different records for different purposes (one for application monitoring, one for security)
• Multiple monitors on same interface with different purposes
• Multiple exporters exporting to different collectors

Understand that monitors are independent and can coexist on the same interface without conflict.

Tip 14: Know When to Use Which Approach

Exam questions test decision-making:

• Scenario: "Need to monitor all IPv4 and IPv6 traffic with minimal configuration."
  Answer: Use built-in "netflow original" record
• Scenario: "Need to monitor only specific application traffic."
  Answer: Create custom record with application match fields
• Scenario: "Router CPU is high from NetFlow."
  Answer: Implement sampling or increase timeout values
• Scenario: "Need to monitor both directions of traffic."
  Answer: Apply monitor with both input and output keywords

Tip 15: Review Verification Command Outputs

Exam includes questions about interpreting outputs. Key things to look for:

• In show flow monitor cache: Active flow count, bytes transferred, packet count, flow duration
• In show flow exporter statistics: Successful export count, template count, error indicators
• In show flow record: Match and collect fields to verify configuration correctness
• In show ip flow interface: Confirmation that monitor is applied to correct direction

Summary Table: FNF Components Quick Reference

Final Exam Strategy

• Read questions carefully: Determine if they're asking about configuration, verification, troubleshooting, or design.
• Identify the component: Determine if the question relates to record, monitor, exporter, or interface application.
• Use elimination: If unsure, eliminate obviously wrong answers (e.g., if asking about flow identity, eliminate collect commands).
• Practice labbing: Configure FNF in a lab environment to build muscle memory and understand outputs.
• Review defaults: Know default values for timeouts and ports (15 sec inactive, 30 min active for FNF).
• Understand relationships: Remember that monitors use records, exporters export from monitors, and monitors apply to interfaces.