Configuring Cisco ISR 4321 Series Devices

    Please use the below commands in the config mode to Configure Cisco ISR 4321 series device to export netflow with NBAR information:

     

    flow record NFArecord

    match ipv4 protocol
    match ipv4 source address
    match ipv4 destination address
    match transport source-port
    match transport destination-port
    match application name
    match interface input 
    collect interface output
    collect ipv4 source mask
    collect ipv4 destination prefix
    collect ipv4 destination mask
    collect counter bytes long
    collect counter packets long
    collect timestamp sys-uptime first
    collect timestamp sys-uptime last

     

    flow exporter NFAexporter

    destination {NFA ServerIP address}
    source {Any L3 interface of the device or Loopback interface}
    transport udp 9996
    template data timeout 60

    option interface-table timeout 60
    option application-table timeout 60

     

    flow monitor NFAmonitor

    exporter NFAexporter
    cache timeout active 60
    record NFArecord

    Please configure the below command in all the L3 interfaces of the device and check:

    ip flow monitor NFAmonitor input