Cisco Nexus (NX-OS)v7.0.20

This page covers Cisco Nexus 9000 Series data-center switches running NX-OS Release 10.3(x). It shows how to mirror traffic with a local SPAN session and how to export flow records (NetFlow v9 or sFlow) to Netmon.

Mirror traffic (SPAN)

Nexus 9000 switches support local SPAN: a monitor session copies traffic from one or more source interfaces to a destination interface, where you connect a Netmon sniffer NIC. The destination port must be put into monitor mode, and a SPAN session is created in the shut state, so you must explicitly enable it with no shut.

1. Configure the destination port (the one cabled to the Netmon sniffer NIC) in access mode and enable SPAN monitoring on it.

   switch# configure terminal
   switch(config)# interface ethernet 2/5
   switch(config-if)# switchport
   switch(config-if)# switchport monitor
   switch(config-if)# no shut
   switch(config-if)# exit
   switch(config)#

2. Create the SPAN session, add the source interface(s) to monitor, set the destination, and bring the session up. Replace the interface numbers with your own — the source interfaces are the ports you want to capture, and the destination is the port you prepared in Step 1.

   switch(config)# no monitor session 3
   switch(config)# monitor session 3 rx
   switch(config-monitor)# source interface ethernet 2/1-3, ethernet 3/1 rx
   switch(config-monitor)# filter vlan 3-5, 7
   switch(config-monitor)# destination interface ethernet 2/5
   switch(config-monitor)# no shut
   switch(config-monitor)# exit
   switch(config)# show monitor session 3
   switch(config)# copy running-config startup-config

   The filter vlan line is optional; omit it to mirror all VLANs on the source interfaces. To capture both directions, replace rx with both (or configure separate rx and tx source lines).

Source: Cisco Nexus 9000 Series NX-OS System Management Configuration Guide, Release 10.3(x) — Switched Port Analyzer. https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/103x/configuration/system-management/cisco-nexus-9000-series-nx-os-system-management-configuration-guide-103x/m-configuring-span-10x.html

Export flow data

Nexus 9000 can export flow data two ways: Flexible NetFlow (NetFlow version 9 only on this platform) and sFlow (RFC 3176). Pick the one your line card / ASIC supports; on many Nexus models NetFlow and sFlow are mutually exclusive, so verify support for your specific model before enabling. NetFlow on Nexus is ingress-only. Netmon listens for NetFlow on UDP 9996 and for sFlow on UDP 6343.

Option A — NetFlow (version 9)

NX-OS defaults the NetFlow export port to UDP 9995, so you must override it to UDP 9996 to reach Netmon.

1. Enable the NetFlow feature.

   switch# configure terminal
   switch(config)# feature netflow

2. Create a flow record defining the keys and counters to collect.

   switch(config)# flow record rr
   switch(config-flow-record)# match ipv4 source address
   switch(config-flow-record)# match ipv4 destination address
   switch(config-flow-record)# collect counter bytes
   switch(config-flow-record)# collect counter packets
   switch(config-flow-record)# exit

3. Create a flow exporter pointing at Netmon. Set the destination to <netmon-ip>, set the source to the interface whose address Netmon knows the device by, select version 9, and override the UDP port to 9996.

   switch(config)# flow exporter ee
   switch(config-flow-exporter)# destination <netmon-ip> use-vrf management
   switch(config-flow-exporter)# source mgmt0
   switch(config-flow-exporter)# transport udp 9996
   switch(config-flow-exporter)# version 9
   switch(config-flow-exporter-version-9)# exit
   switch(config-flow-exporter)# exit

4. Create a flow monitor that ties the record and exporter together.

   switch(config)# flow monitor foo
   switch(config-flow-monitor)# record rr
   switch(config-flow-monitor)# exporter ee
   switch(config-flow-monitor)# exit

5. Apply the monitor to each interface you want to account, in the ingress (input) direction.

   switch(config)# interface ethernet 2/45
   switch(config-if)# ip flow monitor foo input
   switch(config-if)# exit
   switch(config)# copy running-config startup-config

Source: Cisco Nexus 9000 Series NX-OS System Management Configuration Guide, Release 10.3(x) — Configuring NetFlow. https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/103x/configuration/system-management/cisco-nexus-9000-series-nx-os-system-management-configuration-guide-103x/m-configuring-netflow-10x.html

Option B — sFlow

The NX-OS default sFlow collector port is UDP 6343, which already matches Netmon, so no port override is needed.

1. Enable the sFlow feature.

   switch# configure terminal
   switch(config)# feature sflow

2. Configure the collector address (point it at <netmon-ip>), the agent IP that Netmon should see this device as, and the data source interface to sample.

   switch(config)# sflow agent-ip <agent-ip>
   switch(config)# sflow collector-ip <netmon-ip> vrf management
   switch(config)# sflow data-source interface ethernet 1/5
   switch(config)# copy running-config startup-config

   Set <agent-ip> to the address Netmon knows the device by. Use vrf management if Netmon is reached over the management port, or vrf default if it is reached over the front-panel ports. Adjust sflow sampling-rate (default 4096) if you need a different sampling ratio.

Source: Cisco Nexus 9000 Series NX-OS System Management Configuration Guide, Release 10.3(x) — Configuring sFlow. https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/103x/configuration/system-management/cisco-nexus-9000-series-nx-os-system-management-configuration-guide-103x/m-configuring-sflow-10x.html