Cisco TrustSec

C-3
Cisco TrustSec Configuration Guide
OL-22192-01
Appendix C Notes for Catalyst 6500 Series Switches
Flexible NetFlow Support
Configuration Excerpt of an IPv6 Flow Monitor
router(config)# flow monitor cts-monitor-ipv6
router(config-flow-monitor)# record cts-record-ipv6
Configuration Excerpt of the Global Flow Monitor (IPv4 and IPv6)
The following configuration applies the Flow Monitor to packets dropped by Role-Based Access Control
Lists (RBACLs) for all TrustSec interfaces on the router or switch:
router(config)# cts role-based ip flow monitor cts-monitor-ipv4 dropped
router(config)# cts role-based ipv6 flow monitor cts-monitor-ipv6 dropped
Configuration Excerpt of the Interface Monitor
The Flow Monitor can be attached per interface, configured to filter for combinations of ingress (input),
egress (output), multicast, unicast, or Layer2 switched traffic.
For IPv6, flow monitor is supported only for routed traffic in Cisco IOS Release 12.2(50)SY.
router(config)# interface TenGigabitEthernet 8/1
router(config-if)# ip address 192.1.1.1 255.255.255.0
;; Ingress IPv4 unicast only and egress unicast only
router(config-if)# ip flow monitor cts-monitor-ipv4 unicast input
router(config-if)# ip flow monitor cts-monitor-ipv4 unicast output
;; Ingress IPV4 L2-switched traffic only
router(config-if)# ip flow monitor cts-monitor-ipv4 layer2-switched input
;; Ingress Ipv4 multicast and egress IPv4 multicast traffic only
router(config-if)# ip flow monitor cts-monitor-ipv4 multicast input
router(config-if)# ip flow monitor cts-monitor-ipv4 multicast output
;; For both Unicast/multicast egress traffic
router(config-if)# ip flow monitor cts-monitor-ipv4 output
;; For both Unicast/multicast ingress traffic
router(config-if)# ip flow monitor cts-monitor-ipv4 input
;; For Ipv6 only the following are supported in Cisco IOS Release 12.2(50)SY
router(config-if)# ipv6 address 2022::22:1:1:11/64
router(config-if)# ipv6 flow monitor cts-monitor-ipv6 input
router(config-if)# ipv6 flow monitor cts-monitor-ipv6 unicast input
router(config-if)# ipv6 flow monitor cts-monitor-ipv6 output
router(config-if)# ipv6 flow monitor cts-monitor-ipv6 unicast output
Flexible NetFlow Show Commands
show flow record
show flow monitor
show flow exporter
show flow interface
show cts role-based counters
show flow monitor <monitor_name> cache