300-410 NetFlow and Flexible NetFlow — 10 Questions

Question 1

A network engineer is troubleshooting a sudden drop in NetFlow data on a Cisco router running IOS-XE 17.x. The engineer verifies that 'ip flow-export destination 10.1.1.100 2055' is configured, and the collector is reachable. However, 'show ip flow export' shows zero packets exported. What is the most likely cause?

Accepted Answer

No flow monitor is applied to any interface.. The issue is that NetFlow generation requires at least one monitor or flow record to be applied to an interface. Without a 'ip flow monitor' or 'ip route-cache flow' command on an interface, no flows are created and thus nothing is exported.

Answer

The collector IP address is incorrect.

Answer

The export version is set to 9 but the collector expects version 5.

Answer

The router is in a VRF that is not configured for NetFlow export.

Question 2

An engineer configures Flexible NetFlow on a Cisco router to monitor traffic on GigabitEthernet0/1. The flow record is defined with 'match ipv4 source address' and 'collect counter bytes'. The flow exporter sends data to 192.168.1.10:2055. After applying the monitor to the interface, 'show flow monitor name MONITOR cache' shows zero entries. What is the most likely root cause?

Accepted Answer

The flow monitor is applied in the wrong direction.. Flexible NetFlow requires a flow monitor to be applied to an interface in the correct direction (ingress or egress). If the direction is not specified, the default is ingress. If traffic is only egress, the monitor will not capture any flows.

Answer

The flow exporter is not configured with a source interface.

Answer

The flow record does not include 'match ipv4 protocol'.

Answer

The collector is unreachable, causing the router to stop caching flows.

Question 3

A network engineer configures Flexible NetFlow to export traffic statistics for a VRF named CUSTOMER_A. The configuration includes 'flow exporter EXPORTER' with destination 10.10.10.10:2055 and 'vrf CUSTOMER_A' under the exporter. The flow monitor is applied to the VRF interface. However, 'show flow monitor name MONITOR cache' shows no entries for VRF traffic. What is the most likely cause?

Accepted Answer

The flow monitor is applied to the global routing table interface instead of the VRF interface.. For VRF-aware NetFlow, the flow monitor must be applied using the 'ip flow monitor MONITOR input' command under the VRF interface, and the exporter must reference the VRF. A common mistake is forgetting to apply the monitor to the interface in the VRF context.

Answer

The exporter is missing the 'source' interface command.

Answer

The VRF is not configured with 'ip flow-export' commands.

Answer

The flow record does not match any VRF-specific fields.

Question 4

An engineer notices that NetFlow export packets are being sent from a router but the collector reports missing data for certain flows. The engineer checks 'show ip flow export' and sees 'Exporting flows to 10.1.1.100 (2055)' with packets being sent. However, 'show flow monitor name MONITOR cache' shows many flows with zero byte counts. What is the most likely cause?

Accepted Answer

The flow record includes 'collect counter packets' but not 'collect counter bytes'.. If the flow record only collects packet counts but not byte counts, the byte counter will remain zero. This is a configuration error in the flow record definition.

Answer

The flow exporter is using UDP port 2055, but the collector expects TCP.

Answer

The router's CPU is overloaded, causing byte counters to not update.

Answer

The flow monitor is applied in egress direction, which does not support byte collection.

Question 5

A network engineer configures a Flexible NetFlow monitor to capture traffic on a router's WAN interface. The flow record includes 'match ipv4 source address', 'match ipv4 destination address', and 'collect counter bytes'. After applying the monitor, 'show flow monitor name MONITOR cache' shows flows, but the collector receives no data. 'show flow exporter name EXPORTER statistics' shows 'Export packets sent: 0'. What is the most likely cause?

Accepted Answer

The flow monitor is not associated with any flow exporter.. A flow exporter must be associated with the flow monitor. If the monitor does not reference the exporter, no data is exported even if flows are cached.

Answer

The flow exporter is configured with the wrong destination IP address.

Answer

The flow exporter is missing the 'source' interface command.

Answer

The flow cache is full, preventing new exports.

Question 6

An engineer configures Flexible NetFlow on a router to monitor both IPv4 and IPv6 traffic. The flow record is defined with 'match ipv4 source address' and 'match ipv6 source address'. After applying the monitor to an interface, 'show flow monitor name MONITOR cache' shows only IPv4 flows. What is the most likely cause?

Accepted Answer

The flow record cannot combine IPv4 and IPv6 match fields; separate monitors are needed.. A single flow record cannot mix IPv4 and IPv6 match fields; they are separate address families. The engineer must create two separate flow monitors—one for IPv4 and one for IPv6—and apply both to the interface.

Answer

IPv6 traffic is not present on the interface.

Answer

The interface does not have IPv6 enabled.

Answer

The flow exporter is not configured to send IPv6 flows.

Question 7

A network engineer configures NetFlow on a router using the legacy 'ip flow-export' commands. After applying 'ip route-cache flow' on an interface, 'show ip flow export' shows packets being sent, but the collector reports that all flows have a source IP of the router's management interface instead of the actual source IPs. What is the most likely cause?

Accepted Answer

The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.. In legacy NetFlow, the 'ip flow-export source' command sets the source IP of export packets, not the flow data. The symptom described is normal; the collector sees the source IP of the export packets, not the flow source IPs. However, if the collector is misconfigured to interpret the export source as flow source, that is a collector issue. But more likely, the engineer is misreading the collector output. The question tests understanding that export source IP is not the flow source.

Answer

The router is performing NAT on the flow data before exporting.

Answer

The flow record is configured to match the router's interface IP as the source.

Answer

The collector is misconfigured to display the export packet source instead of the flow source.

Question 8

An engineer configures Flexible NetFlow with a flow record that includes 'match ipv4 protocol' and 'collect counter packets'. The flow monitor is applied to an interface. 'show flow monitor name MONITOR cache' shows flows, but the packet counts are much lower than expected based on interface counters. What is the most likely cause?

Accepted Answer

The flow monitor is applied only in the ingress direction, missing egress traffic.. Flexible NetFlow uses sampled NetFlow by default unless 'sampler' is explicitly configured. However, the default sampling rate is 1 (no sampling). The issue might be that the monitor is applied only in one direction (ingress or egress) while traffic is bidirectional, so only half the traffic is captured.

Answer

The flow record does not include 'match ipv4 source address', causing flows to be aggregated incorrectly.

Answer

The router is using sampled NetFlow with a default sampling rate of 1:1000.

Answer

The flow exporter is rate-limiting the export, causing cache entries to be dropped before counting.

Question 9

A network engineer configures Flexible NetFlow on a router to monitor traffic on a trunk interface with multiple VLANs. The flow monitor is applied to the physical interface. The engineer notices that all flows show the same VLAN ID in the collector, even though traffic from different VLANs is present. What is the most likely cause?

Accepted Answer

The flow record does not include any VLAN match fields.. To capture VLAN information in Flexible NetFlow, the flow record must include 'match dot1q vlan' or 'match vlan' fields. Without these, the VLAN ID is not recorded, and the collector may show a default or incorrect value.

Answer

The trunk interface is not configured with 'switchport trunk encapsulation dot1q'.

Answer

The flow monitor is applied only to the physical interface, not the subinterfaces.

Answer

The collector does not support VLAN fields.

Question 10

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1

Flow Exporter EXPORTER-1:
  Description: Exports to collector
  Export protocol: NetFlow Version 9
  Transport Configuration:
    Destination IP address: 192.168.1.100
    Source IP address: 10.0.0.1
    Transport Protocol: UDP
    Destination Port: 2055
    Source Port: 0
  Collector Configuration:
    VRFs:
      Default
  Options Configuration:
    Sampler: Not configured
  Export Statistics:
    Number of Flows exported: 0
    Number of Packets exported: 0
    Number of Source IP address unreachable: 0
    Number of Packets dropped: 0

Based on this output, what is the most likely reason that no flows are being exported?

Accepted Answer

The flow exporter is not referenced in any flow monitor applied to an interface.. The output shows 0 flows exported, but no errors. This often indicates that the flow monitor is not applied to an interface or the exporter is not referenced in a flow monitor. The exporter itself is configured correctly with a valid destination.

Answer

The destination port is incorrect; NetFlow version 9 requires port 9996.

Answer

The source IP address is not reachable from the destination.

Answer

The sampler is not configured, causing all packets to be dropped.