Cisco Catalyst 3850 series User manual

Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release
3SE (Catalyst 3850 Switches)
First Published: January 29, 2013
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-28354-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown
for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
©2013 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface v
Document Conventions v
Related Documentation vii
Obtaining Documentation and Submitting a Service Request vii
CHAPTER 1 Using the Command-Line Interface 1
Information About Using the Command-Line Interface 1
Command Modes 1
Using the Help System 3
Understanding Abbreviated Commands 4
No and default Forms of Commands 4
CLI Error Messages 4
Configuration Logging 5
How to Use the CLI to Configure Features 5
Configuring the Command History 5
Changing the Command History Buffer Size 6
Recalling Commands 6
Disabling the Command History Feature 7
Enabling and Disabling Editing Features 7
Editing Commands through Keystrokes 8
Editing Command Lines That Wrap 10
Searching and Filtering Output of show and more Commands 11
Accessing the CLI on a Switch Stack 12
Accessing the CLI through a Console Connection or through Telnet 12
CHAPTER 2 Configuring Flexible NetFlow 15
Finding Feature Information 15
Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
OL-28354-01 iii

Prerequisites for Flexible NetFlow 15
Prerequisites for Wireless Flexible NetFlow 16
Restrictions for Flexible NetFlow 16
Information About Flexible NetFlow 17
Flexible NetFlow Overview 17
Wireless Flexible NetFlow Overview 18
Flow Records 19
Flexible NetFlow Match Parameters 19
Flexible NetFlow Collect Parameters 21
Exporters 22
Export Formats 23
Monitors 23
Samplers 24
Supported Flexible NetFlow Fields 24
Default Settings 28
How to Configure Flexible NetFlow 29
Creating a Flow Record 29
Creating a Flow Exporter 31
Creating a Flow Monitor 33
Creating a Sampler 35
Applying a Flow to an Interface 37
Configuring a Bridged NetFlow on a VLAN 38
Configuring Layer 2 NetFlow 39
Configuring WLAN to Apply Flow Monitor in Data Link Input/Output Direction 41
Configuring WLAN to Apply Flow Monitor in IPV4 and IPv6 Input/Output Direction 42
Monitoring Flexible NetFlow 43
Configuration Examples for Flexible NetFlow 43
Example: Configuring a Flow 43
Example: Configuring IPv4 Flexible NetFlow in WLAN (Ingress Direction) 44
Example: Configuring IPv6 and Transport Flag Flexible NetFlow in WLAN (Egress
Direction) 45
Example: Configuring IPv6 Flexible NetFlow in WLAN (Both Ingress and Egress
Directions) 45
Additional References 46
Feature Information for Flexible NetFlow 47
Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
iv OL-28354-01
Contents

Preface
This book describes configuration information and examples for Flexible NetFlow on the switch.
•Document Conventions, page v
•Related Documentation, page vii
•Obtaining Documentation and Submitting a Service Request, page vii
Document Conventions
This document uses the following conventions:
DescriptionConvention
Both the ^symbol and Ctrl represent the Control (Ctrl) key on a keyboard.
For example, the key combination ^D or Ctrl-D means that you hold
down the Control key while you press the D key. (Keys are indicated in
capital letters but are not case sensitive.)
^ or Ctrl
Commands and keywords and user-entered text appear in bold font.bold font
Document titles, new or emphasized terms, and arguments for which you
supply values are in italic font.
Italic font
Terminal sessions and information the system displays appear in courier
font.
Courier font
Bold Courier font indicates text that the user must enter.Bold Courier font
Elements in square brackets are optional.[x]
An ellipsis (three consecutive nonbolded periods without spaces) after
a syntax element indicates that the element can be repeated.
...
A vertical line, called a pipe, indicates a choice within a set of keywords
or arguments.
|
Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
OL-28354-01 v

DescriptionConvention
Optional alternative keywords are grouped in brackets and separated by
vertical bars.
[x | y]
Required alternative keywords are grouped in braces and separated by
vertical bars.
{x | y}
Nested set of square brackets or braces indicate optional or required
choices within optional or required elements. Braces and a vertical bar
within square brackets indicate a required choice within an optional
element.
[x {y | z}]
A nonquoted set of characters. Do not use quotation marks around the
string or the string will include the quotation marks.
string
Nonprinting characters such as passwords are in angle brackets.< >
Default responses to system prompts are in square brackets.[ ]
An exclamation point (!) or a pound sign (#) at the beginning of a line
of code indicates a comment line.
!, #
Reader Alert Conventions
This document uses the following conventions for reader alerts:
Means reader take note. Notes contain helpful suggestions or references to material not covered in the
manual.
Note
Means the following information will help you solve a problem.
Tip
Means reader be careful. In this situation, you might do something that could result in equipment damage
or loss of data.
Caution
Means the described action saves time. You can save time by performing the action described in the
paragraph.
Timesaver
Means reader be warned. In this situation, you might perform an action that could result in bodily
injury.
Warning
Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
vi OL-28354-01
Preface
Document Conventions

Related Documentation
Before installing or upgrading the switch, refer to the switch release notes.Note
• Cisco Catalyst 3850 Switch documentation, located at:
http://www.cisco.com/go/cat3850_docs
• Cisco SFP and SFP+ modules documentation, including compatibility matrixes, located at:
http://www.cisco.com/en/US/products/hw/modules/ps5455/tsd_products_support_series_home.html
• Cisco Validated Designs documents, located at:
http://www.cisco.com/go/designzone
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information,
see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco
technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed
and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free
service and Cisco currently supports RSS version 2.0.
Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
OL-28354-01 vii
Preface
Related Documentation

Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
viii OL-28354-01
Preface
Obtaining Documentation and Submitting a Service Request

CHAPTER 1
Using the Command-Line Interface
This chapter contains the following topics:
•Information About Using the Command-Line Interface, page 1
•How to Use the CLI to Configure Features, page 5
Information About Using the Command-Line Interface
This section describes the Cisco IOS command-line interface (CLI) and how to use it to configure your switch.
Command Modes
The Cisco IOS user interface is divided into many different modes. The commands available to you depend
on which mode you are currently in. Enter a question mark (?) at the system prompt to obtain a list of commands
available for each command mode.
When you start a session using Telnet, SSH, or console on the switch, you begin in user mode, often called
user EXEC mode. Only a limited subset of the commands are available in user EXEC mode. For example,
most of the user EXEC commands are one-time commands, such as show commands, which show the current
configuration status, and clear commands, which clear counters or interfaces. The user EXEC commands are
not saved when the switch reboots.
To have access to all commands, you must enter privileged EXEC mode. Normally, you must enter a password
to enter privileged EXEC mode. From this mode, you can enter any privileged EXEC command or enter
global configuration mode.
Using the configuration modes (global, interface, and line), you can make changes to the running configuration.
If you save the configuration, these commands are stored and used when the switch reboots. To access the
various configuration modes, you must start at global configuration mode. From global configuration mode,
you can enter interface configuration mode and line configuration mode.
This table describes the main command modes, how to access each one, the prompt you see in that mode, and
how to exit the mode.
Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
OL-28354-01 1

Table 1: Command Mode Summary
About This ModeExit MethodPromptAccess MethodMode
Use this mode to
• Change
terminal
settings.
• Perform basic
tests.
• Display
system
information.
Enter logout or
quit.
Switch>
Begin a session
using Telnet, SSH,
or console.
User EXEC
Use this mode to
verify commands
that you have
entered. Use a
password to protect
access to this mode.
Enter disable to
exit.
Switch#
While in user EXEC
mode, enter the
enable command.
Privileged EXEC
Use this mode to
configure
parameters that
apply to the entire
switch.
To exit to privileged
EXEC mode, enter
exit or end, or press
Ctrl-Z.
Switch(config)#
While in privileged
EXEC mode, enter
the configure
command.
Global
configuration
Use this mode to
configure VLAN
parameters. When
VTP mode is
transparent, you can
create
extended-range
VLANs (VLAN IDs
greater than 1005)
and save
configurations in the
switch startup
configuration file.
To exit to global
configuration mode,
enter the exit
command.
To return to
privileged EXEC
mode, press Ctrl-Z
or enter end.
Switch(config-vlan)#
While in global
configuration mode,
enter the vlan
vlan-id command.
VLAN
configuration
Use this mode to
configure
parameters for the
Ethernet ports.
To exit to global
configuration mode,
enter exit.
To return to
privileged EXEC
mode, press Ctrl-Z
or enter end.
Switch(config-if)#
While in global
configuration mode,
enter the interface
command (with a
specific interface).
Interface
configuration
Cisco Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
2OL-28354-01
Using the Command-Line Interface
Command Modes