Device Integration: Flow Forwarding from Nexus/Catalyst Switch 4500

TABLE OF CONTENTS

• Overview
• Prerequisites
• Configuration Steps
• Verification (MSSP Only)
  • On the Cisco Switch
  • On ADR CCE
  • On ADR SIEM UI

Overview

This guide explains how to enable NetFlow export on Cisco switches and forward flow statistics to the ADR CCE (Collection and Control Engine). The CCE then forwards flows to the APE (Analytics and Policy Engine) for centralized monitoring, proactive threat detection, and traffic analysis.

In this example, the CCE IP is 40.0.0.2 and the export port is 9995. Replace with your actual deployment values.

Reference: Cisco NetFlow Switching Guide

Prerequisites

• Administrative access to the Cisco switch (console/SSH).

• IOS/IOS-XE or NX-OS image that supports NetFlow.

• ADR CCE IP and UDP port 9995 open.

• Correct system date/time on the switch.

Configuration Steps

1. Enter global configuration mode:
   

   Switch# configure terminal

2. Enable NetFlow switching:

   Switch(config)# ip route-cache flow

3. Configure flow export to ADR CCE:

   Switch(config)# ip flow-export destination 40.0.0.2 9995

4. Choose export version (v5 or v9):

   Switch(config)# ip flow-export version 9

5. Exit and save:

   Switch(config)# end
   Switch# write memory

   
   

Verification (MSSP Only)

On the Cisco Switch

Check export configuration:

Switch# show ip flow export

On ADR CCE

Run:

sudo tcpdump -i any port 9995 and host <Switch_IP> -AAA

On ADR SIEM UI

1. Log in to the ADR SIEM UI.
2. Navigate to: System → Logs and Flows Collection Status.