NetFlow and Catalyst Center Assurance

What it is

NetFlow records who is talking to whom across a router, and Catalyst Center Assurance turns device data into health views and guided fixes.

A flow is a set of packets that share the same key fields, such as source and destination address, ports and protocol. The router counts each flow and exports the records to a collector.

Cisco Catalyst Center, formerly Cisco DNA Center, is a controller for campus networks. Its Assurance feature collects data from managed devices and presents health scores and issues.

How it works

NetFlow is set up on each device, while Assurance runs on the controller.

NetFlow versions

Version 9 and IPFIX send a template first, which tells the collector what each field means. The collector can then read any record the device sends. Flexible NetFlow uses these formats.

Flexible NetFlow

Flexible NetFlow has four parts.

• A flow record says which fields to match as the key and which to collect.
• A flow exporter says where to send records.
• A flow monitor joins a record to an exporter.
• The monitor is applied to an interface in one direction.

R1(config)# flow record REC
R1(config-flow-record)# match ipv4 source address
R1(config-flow-record)# match ipv4 destination address
R1(config-flow-record)# match transport source-port
R1(config-flow-record)# match transport destination-port
R1(config-flow-record)# match ipv4 protocol
R1(config-flow-record)# collect counter bytes
R1(config-flow-record)# collect counter packets
R1(config)# flow exporter EXP
R1(config-flow-exporter)# destination 10.1.1.70
R1(config-flow-exporter)# transport udp 2055
R1(config-flow-exporter)# source Loopback0
R1(config-flow-exporter)# export-protocol netflow-v9
R1(config)# flow monitor MON
R1(config-flow-monitor)# record REC
R1(config-flow-monitor)# exporter EXP
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip flow monitor MON input

To export in IPFIX, the exporter uses export-protocol ipfix. The port is set by the collector, and 2055 is common.

Traditional NetFlow is simpler and uses ip flow ingress on an interface. It cannot be customised in the way a flow record can.

Verifying and troubleshooting NetFlow

R1# show flow monitor MON cache
R1# show flow exporter EXP statistics
R1# show flow interface GigabitEthernet0/0
R1# show flow record REC

show flow monitor MON cache shows live flows, and it is the quickest test that the router is seeing traffic. show flow exporter statistics shows whether records are being sent.

Check these items in order.

• Is the monitor applied to the interface, and in the right direction?
• Does the cache show flows?
• Is the exporter destination reachable, and is the source address allowed?
• Does a firewall block the UDP export port?
• Do the collector and the exporter use the same version and port?

A flow monitor applied to the input direction counts traffic arriving on that interface only. To see both directions, apply it on input and output, or on both ends.

Catalyst Center Assurance

Assurance works on devices that Catalyst Center manages. It gathers data from them, using sources such as syslog, SNMP, NetFlow and streaming telemetry, and shows the result in dashboards.

Think of it as three views.

• Network health shows the state of devices and links across the sites.
• Device health shows one device in detail, including its CPU, memory and interfaces.
• Client health shows wired and wireless clients, and how well they connect.

Each view uses health scores that sum up the condition. When something falls below normal, Assurance raises an issue, and gives the likely cause and suggested actions.

For connectivity problems, the controller provides a path trace tool. It shows the hop by hop path between two points, along with the interfaces and any ACLs that affect the path.

Use the controller for monitoring across the network, and the CLI for detailed checks. Both give the same facts. Assurance finds the area, and the commands on the device confirm the cause.