Initial Configuration › Configure the Product to Work with Performance Center › Configure Flow Collection › Set Up the Routers

Set Up the Routers

Enable NetFlow on each CA Network Flow Analysis router by completing the steps in this topic. You can configure routers to export any of the following flow protocols:

• NetFlow v5, v7, v9, and Sampled NetFlow
• sFlow version 5
• IPFIX, J-Flow, cFlow, and NetStream flow that complies with the standards for NetFlow v5, v7, or v9

Notes:

• Configure flow from each source to be exported to a single Harvester. If flow from one source is exported to multiple Harvesters, a number of problems result. If this occurs, contact CA Support for help.
• NetFlow provides a broad view of your network packet streams by creating flow records for all packets. The data from these flow records represents all packets. Sampled NetFlow/IPFIX and sFlow take samples from your packet streams, producing fewer flow records and lessening the impact to a collector. The lower your sampling rate, the less precise the data is likely to be.

In order for data from non-sampled flows to appear in reports of 15-minute (historical) data, the following minimum fields are required:

• One of the following: 1 - IN_BYTES, 85 - IN_PERMANENT_BYTES, 231 - FW_INITIATOR_OCTETS, or 232 - FW_RESPONDER_OCTETS
• 4 - PROTOCOL
• 7 - L4_SRC_PORT
• 8 - IPV4_SRC_ADDR
• 10 - INPUT_SNMP
• 11 - L4_DST_PORT
• 12 - IPV4_DST_ADDR
• 14 - OUTPUT_SNMP

Complete these tasks:

1. Back up the current router configuration.
2. Configure NetFlow export for each interface individually:
   1. Set the flow export version.
   2. Set the flow source IP address. Cisco recommends that you configure a loopback source interface. The IP addresses of non-loopbacked interfaces can change.
   3. Set the flow destination IP address and set the destination port to 9995. If you are using a custom value for the harvester listening port, use that value as the destination port. The port values must match or the Harvester does not receive flow data.
   4. Set the flow expiration timeout to 1 minute.
3. Enable flow for each interface.
   • NetFlow v5 or v5-compatible flow:
     • Monitoring multiple interfaces on a router: Use either all ingress or all egress. Use the same option for all of the interfaces. Ingress and egress values may vary slightly due to routers dropping packets and changing ToS values as traffic travels between interfaces.
     • Monitoring a single known interface on a router: Use ingress and egress. This option results in fewer total flows from the router to the Harvester and puts less load on the network and the Harvester.
   • NetFlow v9 or v9-compatible flow:

     The Harvester identifies and deduplicates multiple flows on a single router, so you can use ingress and egress on multiple interfaces. You may find it most efficient to use this option for two or three interfaces. You have the option to enable ingress and egress across all interfaces, but this configuration may put an unnecessary burden on the Harvester.

4. Configure SNMP index persistence on each router that supports this feature.