setup netflow on cisco 9300 stack

Setup netflow

x.x.x.x = your netflow collector eg solarwinds etc.

flow exporter NETFLOW-EXP-TO-ORION
 destination x.x.x.x
 source vlan1
 transport udp 2055


Setup what you want to record

flow record NETFLOW-RECORD-IN
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 match flow direction
 collect interface output
 collect counter bytes long
 collect counter packets long

flow record NETFLOW-RECORD-OUT
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface output
 match flow direction
 collect interface input
 collect counter bytes long
 collect counter packets long

Setup the monitors


flow monitor NETFLOW-MON-OUT
 exporter NETFLOW-EXP-TO-ORION
 cache timeout inactive 10
 cache timeout active 60
 record NETFLOW-RECORD-OUT

flow monitor NETFLOW-MON-IN
 exporter NETFLOW-EXP-TO-ORION
 cache timeout inactive 10
 cache timeout active 60
 record NETFLOW-RECORD-IN

Enable the monitors on the interfaces
Enable under the  interfaces you want to collect netflow data from usually these will be uplinks, links to other sites etc





interface GigabitEthernet2/0/36
 ip flow monitor NETFLOW-MON-IN input
 ip flow monitor NETFLOW-MON-OUT output



Don't forget to write your config.
You might need to check firewall rules between the two hosts.
Allow a few minutes for the data to populate in the collector.

configure netflow on cisco router

flow record NETFLOW_RECORD
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 match flow direction
 collect interface output
 collect counter bytes long
 collect counter packets long
!
!
flow exporter NETFLOW_EXPORT_TO_SOLARWINDS
 destination x.x.x.x
 source GigabitEthernet0/0
 transport udp 2055
!
flow monitor NETFLOW_MONITOR
record NETFLOW_RECORD
exporter NETFLOW_EXPORT_TO_SOLARWINDS
cache timeout active 60
cache timeout inactive 15
!
interface gig0/1
ip flow monitor NETFLOW_MONITOR input
ip flow monitor NETFLOW_MONITOR output
!
captures all incoming traffic
route or shortest path

enable netflow on cisco asa

https://supportforums.cisco.com/document/30476/configuring-netflow-asa-asdm

ASDM steps
Device Management > Logging > Netflow
Click Add
Fill in netflow collector server interface and port (usually 2055)

Firewall > Service Policy Rules.
Click Add
Global - applies to all interfaces
Check source and destination IP address (uses ACL)
next
source: any, user: any, destination: any, service: ip, description: netflow
next
Select flow event all, check the send box beside the ip address of the netflow collecter
Finish
Apply


CLI config
access-list global_mpc extended permit ip any any
!
flow-export destination inside 192.168.1.13 2055
!
class-map global_class
  match access-list global_mpc
!
policy-map global_policy
  class inspection_default
   inspect dns migrated_dns_map_1
     inspect ftp
     inspect h323 h225
     inspect h323 ras
     inspect netbios
     inspect rsh
     inspect rtsp
     inspect skinny
     inspect sqlnet
     inspect sunrpc
     inspect tftp
     inspect sip
     inspect xdmcp
     inspect icmp
  class global_class

flow-export event-type all destination 192.168.1.13