Using the example below you will be able to configure a router with Netflow for Cisco Stealthwatch.
Netflow was developed by Cisco and it provides the ability to collect IP network traffic.
Cisco Netflow
R1(config)# R1(config)#ip flow-export ? destination Specify the Destination IP address source Specify the interface for source address version Specify the version number ! R1(config)#ip flow-export destination 192.168.49.56 2055 R1(config)#ip flow-export source loopback 0 R1(config)#ip flow-export version 9 ! ! R1(config)#ip flow-cache timeout ? active Specify the active flow timeout inactive Specify the inactive flow timeout ! R1(config)#ip flow-cache timeout active 1 R1(config)#ip flow-cache timeout inactive 15 ! ! R1(config)#ip flow-capture ? mac-addresses Capture src and dst MAC addresses vlan-id Capture the VLAN id ! R1(config)#ip flow-capture mac-addresses !!Optional R1(config)#ip flow-capture vlan-id !!Optional ! ! !!Enable Netflow on each L3 interface you want to monitor R1(config)#int e0/0 R1(config-if)#ip flow ? ingress Enable inbound NetFlow R1(config-if)#ip flow ingress ! ! R1(config)#do show run | s snmp mmi snmp-timeout 180 snmp-server community cisco RO snmp-server ifindex persist snmp-server host 192.168.49.56 version 2c cisco !!FlowCollector IP
Configure SNMP for your exporters using the SMC Java Client


Verification
R1#show run | s ip flow ip flow-cache timeout active 1 ip flow ingress ip flow-capture vlan-id ip flow-capture mac-addresses ip flow-export source Loopback0 ip flow-export version 9 ip flow-export destination 192.168.49.56 2055 ! ! R1#show ip int brief Interface IP-Address OK? Method Status Protocol Ethernet0/0 192.168.49.200 YES NVRAM up up Ethernet0/1 172.16.1.1 YES manual up up Ethernet0/2 unassigned YES NVRAM administratively down down Ethernet0/3 unassigned YES NVRAM administratively down down Loopback0 172.16.100.1 YES manual up up ! ! R1#show ip cache flow IP packet size distribution (12307 total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .000 .250 .002 .746 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 IP Flow Switching Cache, 278544 bytes 2 active, 4094 inactive, 91 added 4165 ager polls, 0 flow alloc failures Active flows timeout in 1 minutes Inactive flows timeout in 15 seconds IP Sub Flow Cache, 34056 bytes 6 active, 1018 inactive, 135 added, 51 added to flow 0 alloc failures, 0 force free 1 chunk, 1 chunk added last clearing of statistics never Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow UDP-other 45 0.0 2 74 0.0 0.4 15.4 ICMP 44 0.0 277 90 2.3 71.0 5.9 Total: 89 0.0 138 89 2.3 35.3 10.7 SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts Et0/0 192.168.49.1 Et0/1 172.16.1.6 01 0000 0800 9 Et0/0 192.168.49.1 Null 224.0.0.251 11 14E9 14E9 1 ! ! R1#show ip flow export Flow export v9 is enabled for main cache Export source and destination details : VRF ID : Default Source(1) 172.16.100.1 (Loopback0) Destination(1) 192.168.49.56 (2055) Version 9 flow records 76 flows exported in 32 udp datagrams 0 flows failed due to lack of export packet 0 export packets were sent up to process level 0 export packets were dropped due to no fib 0 export packets were dropped due to adjacency issues 0 export packets were dropped due to fragmentation failures 0 export packets were dropped due to encapsulation fixup failures ! ! R1#show ip flow interface Ethernet0/0 ip flow ingress ! ! R1#show ip flow export template Template Options Flag = 0 Total number of Templates added = 2 Total active Templates = 2 Flow Templates active = 2 Flow Templates added = 2 Option Templates active = 0 Option Templates added = 0 Template ager polls = 2549 Option Template ager polls = 0 Main cache version 9 export is enabled Template export information Template timeout = 30 Template refresh rate = 20 Option export information Option timeout = 30 Option refresh rate = 20
After a few minutes you will start seeing flows in your Stealthwatch Management Console (SMC).



