Difference between Netflows on CatCenter and SNA

[Antonio Macia]

Hi there,

We have configured our Catalyst Center as Netflow Collector destination for Application Visibility and, in addition, Secure Network Analytics for et-analytics. What are the differences between the flows received in both destinations? Are we missing any piece of information in the flows collected by SNA when configured as destination of et-analytics only compared with the traditional deployment where SNA is the flow exporter?

Thanks.

[M02@rt37]

Hello @Antonio Macia 

The flows received by Cisco Catalyst Center and Cisco SNA differ in their scope and purpose.

Catalyst Center is configured as a NetFlow collector for AVC and focuses on providing granular visibility into application performance and behavior. It collects detailed NetFlow/IPFIX records, including source and destination IPs, ports, and protocols, as well as metadata like application classifications from NBAR2. Additionally, it gathers performance metrics such as latency/jitter, enabling network operators to monitor application health and enforce application-specific policies. 

In contrast, SNA configured as a destination for Encrypted Traffic Analytics ("ET-Analytics") is purpose-built for analyzing encrypted traffic behavior and detecting encrypted threats. The flows exported for ET-Analytics focus on metadata specific to encrypted sessions, such as initial packet details, sequence of packet lengths and time and TLS handshake information like cipher suites and server certificate details. This data is specialized for identifying anomalies and malicious behavior in encrypted traffic without the need for decryption. However, it lacks broader flow details that traditional NetFlow provides, such as application-layer visibility and performance metrics...

When SNA is used as the flow exporter destination in a traditional deployment, it receives comprehensive NetFlow/IPFIX records, offering visibility into all network traffic, including encrypted and unencrypted flows. However, when configured for ET-Analytics only, SNA receives reduced flow data focused solely on encrypted traffic behavior. This approach omits standard NetFlow information, including detailed application metadata, granular flow statistics, and contextual insights into non-encrypted traffic. As a result, ET-Analytics is highly specialized but not as versatile for general network monitoring.

[Antonio Macia]

Hi M02@rt37 ,

Thanks for the comprehensive explanation. Is there a way to keep sending the same level of detail to SNA and Catalyst Center at the same time? Perhaps a UDP Director o load balancer that might duplicate the flows towards both destinations? We do a heavy usage of SNA for network troubleshooting and insights and we would like to keep the same level of detail as we had before migrating to SDA.

Regards.

[M02@rt37 · Accepted solution]

@Antonio Macia 

If device limitations prevent multiple exports, you should consider deploying a UDP Director or load balancer for flow duplication.

[Antonio Macia]

Thanks M02@rt37 I will create an additional flow exporter for SNA using a CLI template and apply it to our switches.

[Preston Chilcote]

As you noticed, Cat Center isn't currently designed to automate a netflow config that works for both SNA and Application Telemetry.  I worked with the two engineering teams recently and we came up with this netflow config that you can put in a Cat Center Template that should give both tools what they need.  Note, you still need a Cisco Telemetry Broker or other UDP director as each interface only supports one netflow exporter.  You also need SNA version 7.4.2 or later.  We weren't testing for et-analytics though, so I'm not sure how that fits into the puzzle.

flow record dnacrecord
match application name
match connection client ipv4 address
match connection server ipv4 address
match connection server transport port
match flow observation point
match ipv4 protocol
match ipv4 version
collect connection client counter bytes network long
collect connection client counter packets long
collect connection initiator
collect connection new-connections
collect connection server counter bytes network long
collect connection server counter packets long
collect datalink mac source address input
collect flow direction
collect timestamp absolute first
collect timestamp absolute last
collect flow cts source group-tag