Flow

Flow monitoring is a network visibility technology that captures, analyzes, and exports detailed information about network traffic patterns using protocols such as NetFlow v5, NetFlow v9, and IPFIX (IP Flow Information Export). It provides comprehensive traffic analytics by collecting metadata about network conversations including source/destination addresses, ports, protocols, packet counts, byte counts, and timing information without examining actual packet payloads. Flow monitoring enables network administrators to perform capacity planning, security analysis, application performance monitoring, and billing by providing granular insights into network utilization patterns and application behavior.

Diagram

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
flow	Class	[flow]	No

flow (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
exporters	List	[exporters]	No
monitors	List	[monitors]	No
records	List	[records]	No

exporters (iosxe.devices.configuration.flow)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
destination_ip	IP		No
export_protocol	Choice	netflow-v9, netflow-v5, ipfix	No
option_application_attributes_timeout	Integer	min: 1, max: 86400	No
option_application_table_timeout	Integer	min: 1, max: 86400	No
option_interface_table_timeout	Integer	min: 1, max: 86400	No
option_sampler_table	Boolean	true, false	No
option_vrf_table_timeout	Integer	min: 1, max: 86400	No
source_loopback	Integer	min: 0, max: 2147483647	No
source_gigabit_ethernet	String		No
source_two_gigabit_ethernet	String		No
source_five_gigabit_ethernet	String		No
source_ten_gigabit_ethernet	String		No
source_twenty_five_gigabit_ethernet	String		No
source_forty_gigabit_ethernet	String		No
source_hundred_gigabit_ethernet	String		No
source_vlan	Integer	min: 1, max: 4094	No
source_port_channel	Integer	min: 1, max: 512	No
transport_udp	Integer	min: 0, max: 65535	No
template_data_timeout	Integer	min: 1, max: 86400	No
ttl	Integer	min: 0, max: 255	No

monitors (iosxe.devices.configuration.flow)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
exporters	List	String	No
cache_timeout_active	Integer	min: 1, max: 604800	No
cache_timeout_inactive	Integer	min: 1, max: 604800	No
record	String		No

records (iosxe.devices.configuration.flow)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
match	Class	[match]	No
collect	Class	[collect]	No

match (iosxe.devices.configuration.flow.records)

Name	Type	Constraint	Mandatory	Default Value
application_name	Boolean	true, false	No
connection_client_ipv4_address	Boolean	true, false	No
connection_client_ipv6_address	Boolean	true, false	No
connection_server_ipv4_address	Boolean	true, false	No
connection_server_ipv6_address	Boolean	true, false	No
connection_server_transport_port	Boolean	true, false	No
datalink_mac_source_address_input	Boolean	true, false	No
datalink_mac_destination_address_input	Boolean	true, false	No
datalink_vlan	Choice	input, output	No
datalink_source_vlan_id	Boolean	true, false	No
datalink_destination_vlan_id	Boolean	true, false	No
flow_direction	Boolean	true, false	No
flow_observation_point	Boolean	true, false	No
interface_input	Boolean	true, false	No
ipv4_destination_address	Boolean	true, false	No
ipv4_protocol	Boolean	true, false	No
ipv4_source_address	Boolean	true, false	No
ipv4_tos	Boolean	true, false	No
ipv4_ttl	Boolean	true, false	No
ipv4_version	Boolean	true, false	No
ipv6_destination_address	Boolean	true, false	No
ipv6_protocol	Boolean	true, false	No
ipv6_source_address	Boolean	true, false	No
ipv6_version	Boolean	true, false	No
transport_destination_port	Boolean	true, false	No
transport_source_port	Boolean	true, false	No
routing_vrf_input	Boolean	true, false	No
vxlan_vnid	Boolean	true, false	No
vxlan_vtep_input	Boolean	true, false	No
vxlan_vtep_output	Boolean	true, false	No

match (iosxe.devices.configuration.flow.records)

Name	Type	Constraint	Mandatory	Default Value
application_name	Boolean	true, false	No
connection_client_ipv4_address	Boolean	true, false	No
connection_client_ipv6_address	Boolean	true, false	No
connection_server_ipv4_address	Boolean	true, false	No
connection_server_ipv6_address	Boolean	true, false	No
connection_server_transport_port	Boolean	true, false	No
datalink_mac_source_address_input	Boolean	true, false	No
datalink_mac_destination_address_input	Boolean	true, false	No
datalink_vlan	Choice	input, output	No
datalink_source_vlan_id	Boolean	true, false	No
datalink_destination_vlan_id	Boolean	true, false	No
flow_direction	Boolean	true, false	No
flow_observation_point	Boolean	true, false	No
interface_input	Boolean	true, false	No
ipv4_destination_address	Boolean	true, false	No
ipv4_protocol	Boolean	true, false	No
ipv4_source_address	Boolean	true, false	No
ipv4_tos	Boolean	true, false	No
ipv4_ttl	Boolean	true, false	No
ipv4_version	Boolean	true, false	No
ipv6_destination_address	Boolean	true, false	No
ipv6_protocol	Boolean	true, false	No
ipv6_source_address	Boolean	true, false	No
ipv6_version	Boolean	true, false	No
transport_destination_port	Boolean	true, false	No
transport_source_port	Boolean	true, false	No

collect (iosxe.devices.configuration.flow.records)

Name	Type	Constraint	Mandatory	Default Value
connection_initiator	Boolean	true, false	No
connection_new_connections	Boolean	true, false	No
connection_server_counter_bytes_network_long	Boolean	true, false	No
connection_server_counter_packets_long	Boolean	true, false	No
counter_bytes_long	Boolean	true, false	No
counter_packets_long	Boolean	true, false	No
datalink_mac_source_address_input	Boolean	true, false	No
flow_direction	Boolean	true, false	No
interface_output	Boolean	true, false	No
timestamp_absolute_first	Boolean	true, false	No
timestamp_absolute_last	Boolean	true, false	No
transport_tcp_flags	Boolean	true, false	No

Sample Configuration

flow exporter EXPORTER-DOC
 description Flow exporter with port-channel source
 destination 10.1.1.100
 source Port-channel10
 transport udp 2055
!
flow record RECORD-DOC
 description Flow record with observation point and server attributes
 match flow observation point
 match flow direction
 match connection server transport port
 match ipv4 destination address
 match ipv4 protocol
 match ipv4 source address
 match interface input
 match transport destination port
 match transport source port
 collect flow direction
 collect connection server counter bytes network long
 collect interface output
 collect counter bytes long
!
flow monitor MONITOR-DOC
 description Flow monitor
 exporter EXPORTER-DOC
 cache timeout active 60
 record RECORD-DOC

Examples

Example 1: The example below shows configuration to monitor IPv4 traffic flows based on specified match criteria and send it to a remote collector. It configures 1 monitor which associates a flow record and a flow exporter, and manage flow cache. Flow exporter contains information to send data to the remote collector with attirbutes like destination IP, source loopback, protocol, port, TTL (Time To Live), etc. The flow record defines the specifics fields to match and collect from network traffic flows.

iosxe:
  devices:
    - name: Device1
      configuration:
        flow:
          exporters:
            - name: exporter1
              description: My exporter
              destination_ip: 1.1.1.1
              export_protocol: ipfix
              option_application_attributes_timeout: 30
              option_application_table_timeout: 40
              option_interface_table_timeout: 50
              option_sampler_table: true
              option_vrf_table_timeout: 60
              source_loopback: 123
              transport_udp: 655
              ttl: 64
              template_data_timeout: 60
          monitors:
            - name: MON1
              description: My monitor
              exporters:
                - exporter1
              cache_timeout_active: 60
              record: FNF1
          records:
            - name: FNF1
              description: My flow record
              match:
                ipv4_source_address: true
                ipv4_destination_address: true
                ipv4_protocol: true
                ipv4_tos: true
                transport_source_port: true
                transport_destination_port: true
                interface_input: true
                flow_direction: true
                flow_observation_point: true
                connection_server_transport_port: true
              collect:
                interface_output: true
                counter_bytes_long: true
                counter_packets_long: true
                transport_tcp_flags: true
                timestamp_absolute_first: true
                timestamp_absolute_last: true
                flow_direction: true
                connection_server_counter_bytes_network_long: true

Example 2: Enhanced Layer 2 flow monitoring with MAC address and VLAN matching. This example demonstrates the new datalink layer visibility capabilities available on switch platforms, enabling detailed tracking of Layer 2 traffic patterns including source/destination MAC addresses and VLAN-based flow identification.

iosxe:
  devices:
    - name: Switch1
      configuration:
        flow:
          exporters:
            - name: L2_EXPORTER
              description: Layer 2 Flow Exporter
              destination_ip: 10.0.0.100
              source_vlan: 100
              transport_udp: 2055
              template_data_timeout: 600
          monitors:
            - name: L2_MONITOR
              description: Layer 2 Flow Monitor
              exporters:
                - L2_EXPORTER
              cache_timeout_active: 300
              cache_timeout_inactive: 15
              record: L2_RECORD
          records:
            - name: L2_RECORD
              description: Enhanced L2 flow record with MAC and VLAN tracking
              match:
                ipv4_source_address: true
                ipv4_destination_address: true
                ipv4_protocol: true
                datalink_mac_source_address_input: true
                datalink_mac_destination_address_input: true
                datalink_vlan: input
                ipv4_ttl: true
              collect:
                counter_bytes_long: true
                counter_packets_long: true
                interface_output: true

Example 3: Flow exporter with flexible source interface options. This example demonstrates the various source interface types available for flow exporters, including physical ethernet interfaces, VLAN interfaces, and port-channels, providing deployment flexibility across different network topologies.

iosxe:
  devices:
    - name: Router1
      configuration:
        flow:
          exporters:
            - name: EXPORTER_LOOPBACK
              description: Exporter with Loopback source
              destination_ip: 10.1.1.10
              source_loopback: 100
              transport_udp: 2055
            - name: EXPORTER_GIGABIT
              description: Exporter with GigabitEthernet source
              destination_ip: 10.1.1.11
              source_gigabit_ethernet: "1/0/1"
              transport_udp: 2056
            - name: EXPORTER_TENGIG
              description: Exporter with TenGigabitEthernet source
              destination_ip: 10.1.1.12
              source_ten_gigabit_ethernet: "1/0/1"
              transport_udp: 2057
            - name: EXPORTER_PORTCHANNEL
              description: Exporter with Port-channel source
              destination_ip: 10.1.1.13
              source_port_channel: 10
              transport_udp: 2058
          records:
            - name: ROUTER_RECORD
              description: Router flow record with enhanced VLAN tracking
              match:
                ipv4_source_address: true
                ipv4_destination_address: true
                ipv4_protocol: true
                transport_source_port: true
                transport_destination_port: true
                datalink_mac_source_address_input: true
                datalink_mac_destination_address_input: true
                datalink_source_vlan_id: true
                datalink_destination_vlan_id: true
                ipv4_ttl: true
              collect:
                counter_bytes_long: true
                counter_packets_long: true
                transport_tcp_flags: true
                timestamp_absolute_first: true
                timestamp_absolute_last: true
          monitors:
            - name: MULTI_EXPORTER_MONITOR
              description: Monitor using multiple exporters
              exporters:
                - EXPORTER_LOOPBACK
                - EXPORTER_GIGABIT
                - EXPORTER_TENGIG
              cache_timeout_active: 1800
              cache_timeout_inactive: 30
              record: ROUTER_RECORD

Example 4: VXLAN-aware NetFlow configuration for overlay network monitoring. This example demonstrates the use of VXLAN-specific match fields including VNID (VXLAN Network Identifier), VTEP (VXLAN Tunnel Endpoint) input/output, VRF input routing, and datalink VLAN matching. These fields enable detailed visibility into VXLAN overlay traffic flows for network segmentation and troubleshooting.

iosxe:
  devices:
    - name: Device1
      configuration:
        flow:
          exporters:
            - name: vxlan_exporter
              description: VXLAN flow exporter
              destination_ip: 10.1.1.100
              export_protocol: ipfix
              source_loopback: 0
              transport_udp: 2055
              template_data_timeout: 60
          monitors:
            - name: VXLAN_MONITOR
              description: VXLAN overlay monitoring
              exporters:
                - vxlan_exporter
              cache_timeout_active: 120
              cache_timeout_inactive: 30
              record: VXLAN_RECORD
          records:
            - name: VXLAN_RECORD
              description: VXLAN-aware flow record for overlay network monitoring
              match:
                ipv4_source_address: true
                ipv4_destination_address: true
                ipv4_protocol: true
                transport_source_port: true
                transport_destination_port: true
                datalink_vlan: input
                routing_vrf_input: true
                vxlan_vnid: true
                vxlan_vtep_input: true
                vxlan_vtep_output: true
              collect:
                interface_output: true
                counter_bytes_long: true
                counter_packets_long: true
                timestamp_absolute_first: true
                timestamp_absolute_last: true

Examples

Example 1: The example below shows configuration to monitor IPv4 traffic flows based on specified match criteria and send it to a remote collector. It configures 1 monitor which associates a flow record and a flow exporter, and manage flow cache. Flow exporter contains information to send data to the remote collector with attirbutes like destination IP, source loopback, protocol, port, TTL (Time To Live), etc. The flow record defines the specifics fields to match and collect from network traffic flows.

iosxe:
  devices:
    - name: Device1
      configuration:
        flow:
          exporters:
            - name: exporter1
              description: My exporter
              destination_ip: 1.1.1.1
              export_protocol: ipfix
              option_application_attributes_timeout: 30
              option_application_table_timeout: 40
              option_interface_table_timeout: 50
              option_sampler_table: true
              option_vrf_table_timeout: 60
              source_loopback: 123
              transport_udp: 655
              ttl: 64
              template_data_timeout: 60
          monitors:
            - name: MON1
              description: My monitor
              exporters:
                - exporter1
              cache_timeout_active: 60
              record: FNF1
          records:
            - name: FNF1
              description: My flow record
              match:
                ipv4_source_address: true
                ipv4_destination_address: true
                ipv4_protocol: true
                ipv4_tos: true
                transport_source_port: true
                transport_destination_port: true
                interface_input: true
                flow_direction: true
              collect:
                interface_output: true
                counter_bytes_long: true
                counter_packets_long: true
                transport_tcp_flags: true
                timestamp_absolute_first: true
                timestamp_absolute_last: true

Example 2: Enhanced Layer 2 flow monitoring with MAC address and VLAN matching. This example demonstrates the new datalink layer visibility capabilities available on switch platforms, enabling detailed tracking of Layer 2 traffic patterns including source/destination MAC addresses and VLAN-based flow identification.

iosxe:
  devices:
    - name: Switch1
      configuration:
        flow:
          exporters:
            - name: L2_EXPORTER
              description: Layer 2 Flow Exporter
              destination_ip: 10.0.0.100
              source_vlan: 100
              transport_udp: 2055
              template_data_timeout: 600
          monitors:
            - name: L2_MONITOR
              description: Layer 2 Flow Monitor
              exporters:
                - L2_EXPORTER
              cache_timeout_active: 300
              cache_timeout_inactive: 15
              record: L2_RECORD
          records:
            - name: L2_RECORD
              description: Enhanced L2 flow record with MAC and VLAN tracking
              match:
                ipv4_source_address: true
                ipv4_destination_address: true
                ipv4_protocol: true
                datalink_mac_source_address_input: true
                datalink_mac_destination_address_input: true
                datalink_vlan: input
                ipv4_ttl: true
              collect:
                counter_bytes_long: true
                counter_packets_long: true
                interface_output: true

Example 3: Flow exporter with flexible source interface options. This example demonstrates the various source interface types available for flow exporters, including physical ethernet interfaces, VLAN interfaces, and port-channels, providing deployment flexibility across different network topologies.

iosxe:
  devices:
    - name: Router1
      configuration:
        flow:
          exporters:
            - name: EXPORTER_LOOPBACK
              description: Exporter with Loopback source
              destination_ip: 10.1.1.10
              source_loopback: 100
              transport_udp: 2055
            - name: EXPORTER_GIGABIT
              description: Exporter with GigabitEthernet source
              destination_ip: 10.1.1.11
              source_gigabit_ethernet: "1/0/1"
              transport_udp: 2056
            - name: EXPORTER_TENGIG
              description: Exporter with TenGigabitEthernet source
              destination_ip: 10.1.1.12
              source_ten_gigabit_ethernet: "1/0/1"
              transport_udp: 2057
          records:
            - name: ROUTER_RECORD
              description: Router flow record with enhanced VLAN tracking
              match:
                ipv4_source_address: true
                ipv4_destination_address: true
                ipv4_protocol: true
                transport_source_port: true
                transport_destination_port: true
                datalink_mac_source_address_input: true
                datalink_mac_destination_address_input: true
                datalink_source_vlan_id: true
                datalink_destination_vlan_id: true
                ipv4_ttl: true
              collect:
                counter_bytes_long: true
                counter_packets_long: true
                transport_tcp_flags: true
                timestamp_absolute_first: true
                timestamp_absolute_last: true
          monitors:
            - name: MULTI_EXPORTER_MONITOR
              description: Monitor using multiple exporters
              exporters:
                - EXPORTER_LOOPBACK
                - EXPORTER_GIGABIT
                - EXPORTER_TENGIG
              cache_timeout_active: 1800
              cache_timeout_inactive: 30
              record: ROUTER_RECORD