Cisco Flexible Netflow for Solarwinds Example

Recently I was asked to configure Flexible Netflow on a Cisco CSR1000V running IOS-XE version 16.8.1a for Solarwinds Orion.

Amazingly there didn’t seem to be much in the way of examples on the Interweb that actually worked, so to cut to the chase here is a config that worked for me:

Step 1: Define what to match and in which direction (inbound or outbound). Here’s an example of basic IPv4 traffic I wanted to capture. Note the long option is needed for Solarwinds.

conf t
flow record IPV4
description Define IPV4 Netflow
match ipv4 source address
match ipv4 destination address
match ipv4 protocol
match ipv4 tos
match transport source-port
match transport destination-port
match interface input
collect interface output
collect counter bytes long
collect counter packets long

Step 2: Define the Solarwinds Orion instance you want to export data to.

conf t
flow exporter SOLARWINDS
description Define Solarwinds as the collector
destination <destination IP>
source <source interface>
transport udp 2055

Step 3: Define a ‘monitor’ that can then be applied to the interfaces you want to, well monitor.

conf t
flow monitor SOLARWINDS-MONITOR
description Config to apply to interfaces
exporter SOLARWINDS
cache timeout active 60
record IPV4

Step 4: Apply the monitor to the interfaces you want to monitor

conf t
interface <interface>
ip flow monitor SOLARWINDS-MONITOR input

Step 5: Check you are getting some sensible output generated

show flow monitor SOLARWINDS-MONITOR cache

If this worked for you, let me know. If it didn’t or there are further tweaks you found useful also let me know 🙂