Skip to main content
Viptela is now part of Cisco.
Support
Product Documentation
Viptela Documentation

Cflowd Traffic Flow Monitoring Configuration Example

This article shows a straightforward example of configuring traffic flow monitoring.

Configuration Steps

You enable cflowd traffic monitoring with a centralized data policy, so all configuration is done on a vSmart controller. The following example procedure monitors all TCP traffic, sending it to a single collector:

  1. Create a cflowd template to define the location of the collector and to modify cflowd timers:
    vSmart(config)# policy cflowd-template test-cflowd-template
    vSmart(config-cflowd-template-test-cflowd-template)# collector vpn 1 address 172.16.155.15 port 13322 transport transport_udp
    vSmart(config-cflowd-template-test-cflowd-template)# flow-inactive-timeout 60
    vSmart(config-cflowd-template-test-cflowd-template)# template-refresh 90
  2. Create a list of VPNs whose traffic you want to monitor:
    vSmart(config)# policy lists vpn-list vpn_1 vpn 1
  3. Create a list of sites to apply the data policy to:
    vSmart(config)# policy lists site-list cflowd-sites site-id 400,500,600
  4. Configure the data policy itself:
    vSmart(config)# policy data-policy test-cflowd-policy
    vSmart(config-data-policy-test-cflowd-policy)# vpn-list vpn_1
    vSmart(config-vpn-list-vpn_1)# sequence 1
    vSmart(config-sequence-1)# match protocol 6
    vSmart(config-match)# exit
    vSmart(config-sequence-1)# action accept cflowd
    ​vSmart(config-action)# exit
    vSmart(config-sequence-1)# exit
    vSmart(config-vpn-list-vpn_1)# default-action accept
  5. Apply the policy and the cflowd template to sites in the overlay network:
    vSmart(config)# apply-policy site-list cflowd-sites data-policy test-cflowd-policy
    ​vSmart(config-site-list-cflowd-sites)# cflowd-template test-cflowd-template
  6. Activate the data policy:
    vSmart(config-site-list-cflowd-sites)# validate
    Validation complete
    vSmart(config-site-list-cflowd-sites)# commit
    Commit complete.
    vSmart(config-site-list-cflowd-sites)# exit configuration-mode
    vSmart#

Full Example Configuration

Here is what the full example cflowd configuration looks like:

vSmart(config)# show configuration
apply-policy
 site-list cflowd-sites
  data-policy     test-cflowd-policy
  cflowd-template test-cflowd-template
 !
!
policy
 data-policy test-cflowd-policy
  vpn-list vpn_1
   sequence 1
    match
     protocol 6
    !
    action accept
     cflowd
    !
   !
   default-action accept
  !
 !
 cflowd-template test-cflowd-template
  flow-inactive-timeout 60
  template-refresh      90
  collector vpn 1 address 172.16.155.15 port 13322 transport transport_udp
 !
 lists
  vpn-list vpn_1
   vpn 1
  !
  site-list cflowd-sites
   site-id 400,500,600
  !
 !
!

Check the Cflowd Configuration

After you activate the cflowd configuration on the vSmart controller, you can check it with the show running-config policy and show running-config apply-policy commands on the vSmart controller. In addition, the configuration is immediately pushed down to the vEdge routers at the affected sites. You can view the pushed cflowd template with the show policy from-vsmart cflowd command. Here is the output from a router at site 500:

vEdge# show policy from-vsmart cflowd-template 
from-vsmart cflowd-template test-cflowd-template
 flow-active-timeout   30
 flow-inactive-timeout 60
 template-refresh      90
 collector vpn 1 address 172.16.155.15 port 13322 transport transport_udp

You can view all the pushed policy components with the show policy from-vsmart command:

vEdge# show policy from-vsmart 
from-vsmart data-policy test-cflowd-policy
 vpn-list vpn_1
  sequence 1
   match
    protocol 6
   action accept
    cflowd
  default-action accept
from-vsmart cflowd-template test-cflowd-template
 flow-active-timeout   30
 flow-inactive-timeout 60
 template-refresh      90
 collector vpn 1 address 172.16.155.15 port 13322 transport transport_udp
from-vsmart lists vpn-list vpn_1
 vpn 1

Check the Flows

On the vEdge routers affected by the cflowd data policy, various commands let you check the status of the cflowd flows.

To display information about the flows themselves:

vEdge# show app cflowd flows
                                                            TCP                                                                                        TIME    
                                 SRC    DEST         IP     CNTRL  ICMP             EGRESS  INGRESS  TOTAL  TOTAL  MIN  MAX                            TO      
VPN  SRC IP       DEST IP        PORT   PORT   DSCP  PROTO  BITS   OPCODE  NHOP IP  INTF    INTF     PKTS   BYTES  LEN  LEN  START TIME                EXPIRE  
---------------------------------------------------------------------------------------------------------------------------------------------------------------
1    10.20.24.15  172.16.155.15  46772  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:31:45 2014  3       
1    10.20.24.15  172.16.155.15  46773  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:31:50 2014  8       
1    10.20.24.15  172.16.155.15  46774  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:31:55 2014  13      
1    10.20.24.15  172.16.155.15  46775  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:00 2014  18      
1    10.20.24.15  172.16.155.15  46776  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:05 2014  23      
1    10.20.24.15  172.16.155.15  46777  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:10 2014  28      
1    10.20.24.15  172.16.155.15  46778  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:15 2014  33      
1    10.20.24.15  172.16.155.15  46779  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:19 2014  38      
1    10.20.24.15  172.16.155.15  46780  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:25 2014  43      
1    10.20.24.15  172.16.155.15  46781  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:30 2014  48      
1    10.20.24.15  172.16.155.15  46782  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:35 2014  53      
1    10.20.24.15  172.16.155.15  46783  13322  0     6      2      0       0.0.0.0  0       0        1      78     78   78   Wed Nov 19 12:32:40 2014  58  

To quickly get a count of the number of flows:

vEdge# show app cflowd flow-count 

VPN  count  
------------
1    12 

To display flow statistics:

vEdge# show app cflowd statistics 

      data_packets             :      0 
      template_packets         :      0 
      total-packets            :      0 
      flow-refresh             :      123 
      flow-ageout              :      117 
      flow-end-detected        :      0 
      flow-end-forced          :      0 

The following commands show information about the cflowd collectors and the cflowd template information that is sent to the collector:

vEdge# show app cflowd collector 

VPN  COLLECTOR IP   COLLECTOR  CONNECTION            IPFIX    CONNECTION  TEMPLATE  DATA     
ID   ADDRESS        PORT       STATE       PROTOCOL  VERSION  RETRY       PACKETS   PACKETS  
---------------------------------------------------------------------------------------------
1    172.16.155.15  13322      false       TCP       10       133         0         0        

vEdge# show app cflowd template 
app cflowd template name test-cflowd-template
app cflowd template flow-active-timeout 30
app cflowd template flow-inactive-timeout 60
app cflowd template template-refresh 90
  • Was this article helpful?