We can suggest following configuration from ASR 1000 (including 1001-X) series of Cisco routers:

flow record netflow_record_v4
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect interface output
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last

flow record netflow_record_v6
 match ipv6 protocol
 match ipv6 source address
 match ipv6 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect routing next-hop address ipv6
 collect ipv6 dscp
 collect ipv6 hop-limit minimum
 collect ipv6 hop-limit maximum
 collect transport tcp flags
 collect interface output
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last

flow exporter netflow_exporter
 destination 10.10.10.1
 source Loopback0
 transport udp 2055
 template data timeout 60
 option interface-table timeout 60
 option sampler-table timeout 60

flow monitor netflow_monitor_v4
 exporter netflow_exporter
 cache timeout active 30
 cache timeout inactive 30
 record netflow_record_v4

flow monitor netflow_monitor_v6
 exporter netflow_exporter
 cache timeout active 30
 cache timeout inactive 30
 record netflow_record_v6

sampler sampler
 mode random 1 out-of 1000

Also, please set these options for all interfaces:

 ip flow monitor netflow_monitor_v4 sampler sampler input
 ip flow monitor netflow_monitor_v4 sampler sampler output
 ipv6 flow monitor netflow_monitor_v6 sampler sampler input
 ipv6 flow monitor netflow_monitor_v6 sampler sampler output

FastNetMon can detect sampling rate from routers automatically in almost all cases. You can check detected sampling rate per router this way:

sudo fcli show netflow_sampling_rates

It may detect sampling rate incorrectly when you have multiple samplers configured on routers. That’s technical restriction, please avoid this configuration. FastNetMon can detect sampling rate when your have only single sampler. As option, if you need multiple samplers, please set them to same sampling rate.

Also, you may check system counters to confirm that FastNetMon received and decoded sampling announcements from routers:

sudo fcli show system_counters |grep netflow9 |grep sampling
netflow9_custom_sampling_rate_received           8688 
netflow9_sampling_rate_changes                   1

If you see zero values you may check that FastNetMon received options Netflow packets (they carry all meta information about Netflow exporters):

sudo fcli show system_counters |grep netflow9 |grep options
netflow9_options_templates_number                844 
netflow9_options_packet_number                   1448

As fallback option you can configure sampling rate manually in FastNetMon this way:

sudo fcli set main netflow_sampling_ratio 1000

For specified active and inactive timeouts we can suggest using following average calculation time values:

sudo fcli set main average_calculation_time 60
sudo fcli commit

If you noticed incorrect bandwidth calculation, we can suggest using visual traffic for debugging purposes.

And after that, please check out dashboard “Netflow v9 metrics” from default dashboard list.

24/7 Tech Support

support@fastnetmon.com

Email Us

sales@fastnetmon.com