Configuring Cisco 3850 and 3925

This document outlines the necessary commands to configure Cisco 3850 switches and Cisco Router 3925. It includes definitions for flow records, exporters, and monitors, as well as instructions for applying them to device interfaces.

Configuration Steps

Define Flow Records

flow record MFE1
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect interface output
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last

flow record MFEout
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface output
collect interface input
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last

Configure Flow Exporter

flow exporter MFE
destination {server ip address}
transport udp 2055
template data timeout 60

Establish Flow Monitors

flow monitor MFE1
exporter MFE
cache timeout active 60
record MFE1

flow monitor MFEout
exporter MFE
cache timeout active 60
record MFEout

Apply Flow Monitors to Interfaces For each interface, use the following commands:

ip flow monitor MFE1 input
ip flow monitor MFEout output

For example, for GigabitEthernet1/1/1:

interface GigabitEthernet1/1/1
ip flow monitor MFE1 input
ip flow monitor MFEout output

After completing the configuration, navigate to Menu > Flow Explorer and select Explorer to view the active flow data.