How to config input/output interface for NetFlow on Catalyst switch?

[jmaxwellUSAF]

Hello.

I'm at the very end of inserting NetFlow config on Catalyst 9300 switchstack. I'm using successful template of routers.

Below errors intuitively make sense, because these are switchports, and they may need to be layer 3 ports (?)...

---

#sh ver
Cisco IOS XE Software, Version 17.09.04
Cisco IOS Software [Cupertino], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 17.9.4, RELEASE SOFTWARE (fc5)

---

CAT-9300-stack# int vlan77
CAT-9300-stack(config-if)# ip flow monitor MONITOR-1 input
% Flow Monitor: Failed to add monitor to interface: Invalid set of fields in monitor record for wired interface

CAT-9300-stack# int g7/7/7
CAT-9300-stack(config-if)# Ip flow monitor MONITOR-1 input
% Flow Monitor: Failed to add monitor to interface: Invalid set of fields in monitor record for wired interface

4#sh flow monitor

Flow Monitor MONITOR-1:
Description: User defined
Flow Record: RECORD-1
Flow Exporter: EXPORTER-1
Cache:
Type: normal (Platform cache)
Status: not allocated
Size: 10000 entries

---

OK then, what must I do to successfully finish this NetFlow config? 

Thank you!

[M02@rt37 · Accepted solution]

Hello @jmaxwellUSAF,

You need to configure:

- flow record

- flow exporter 

- flow monitor 

- flow sampler (optional)

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-5/configuration_guide/nmgmt/b_165_nmgmt_9300_cg/b_165_nmgmt_9300_cg_chapter_01000.html

https://www.plixer.com/blog/cisco-catalyst-9300-netflow-configuration/

[jmaxwellUSAF]

Im making progress...

1. enable
2. configure terminal
3. flow record record-name
4. description description
5. match {ip | ipv6 } {destination | source } address
6. Repeat Step 5 as required to configure additional key fields for the record.
7. match flow cts {source | destination } group-tag
8.  
9. Repeat the above step as required to configure additional nonkey fields for the record.
10. end

---

QUESTION: "match flow cts {source | destination } group-tag" -- Is this line necessary?

Thank you.

[M02@rt37]

@jmaxwellUSAF,

If you're not utilizing Cisco TrustSec and if you don't need to match flows based on CTS group tags, then you can omit this line from the configuration.