24.01.2019

FastNetMon Netflow v9 configuration for Cisco ASR 9000

Cisco ASR 9000 series routers have solid support for Netflow and can generate Netflow for quite big amount of traffic without any issues. But considering amount of available port capacity on these routers, we suggest using sampling by default to avoid control plane CPU overload.

We can suggest following configuration from ASR 9000 series of Cisco routers:

If you prefer IPFIX you can replace “v9” by “ipfix” in this configuration. Also, please replace “10.0.0.1” in this configuration by address of machine where you have FastNetMon.

Also, please set this option for all interfaces:

FastNetMon can detect sampling rate from routers automatically in almost all cases. You can check detected sampling rate per router this way:

It may detect sampling rate incorrectly when you have multiple samplers configured on routers. That’s technical restriction, please avoid this configuration. FastNetMon can detect sampling rate when your have only single sampler. As option, if you need multiple samplers, please set them to same sampling rate.

Also, you may check system counters to confirm that FastNetMon received and decoded sampling announcements from routers:

If you see zero values you may check that FastNetMon received options Netflow packets (they carry all meta information about Netflow exporters):

As fallback option you can configure sampling rate manually in FastNetMon this way:

For specified active and inactive timeouts we can suggest using following average calculation time values:

If you noticed incorrect bandwidth calculation, we can suggest using visual traffic for debugging purposes, please enable export of system counters to InfluxDB:

And after that, please check out dashboard “Netflow v9 metrics” from default dashboard list.

Few times on routers with significant amount of traffic we noticed that router exports only quite small amount of all flows and FastNetMon see very small traffic.

It may be caused by internal rate limit about number of flows exported per second.

You can increase it this way using undocumented engineering command:

Please be careful with this command and increase it in multiple stages. We tried values up to 32 000 and it works pretty well.