Cisco NetFlow Version 5.0 Setup
Netflow Version 5 is the most popular and one of the simplest versions of netflow to enable. Its popular due to its almost ubiquitous support on Cisco routers as well as the fact that it is also the most efficient in terms of bandwidth usage.
To enable netflow you must first enable the global set of commands:
- ip flow-export destination ip_address port
- ip flow-export source interface
- ip flow-export version 5 [peer-as | origin-as]
- ip flow-cache timeout active 1
- ip flow-cache timeout inactive 15
- snmp-server ifindex persist
Then enable netflow on all layer 3 interfaces you wish to monitor: On older devices use:
- ip route-cache flow
Newer devices would use
- ip flow ingress
There is also the "ip flow egress" command. This would be used under special circumstances where the above commands can't be applied or you want to capture the Netflow after traffic has been marked.