Skip to main content
Version: Next

Application Enrichment — Cisco AVC

note

Enriched fields produced by this configuration are applied and available in the Network Conversations Module output.

Cisco Application Visibility and Control (AVC) enriches flow records from ASR1k and ISR-G2 routers with NBAR2 application names, Application Response Time (ART), and URL data. This gives NFO the application context needed to move beyond port-based traffic analysis to named, layer-7 visibility.

How It Works​

AVC classification runs on the router itself using the NBAR2 engine. The router inspects traffic, tags each flow with an application name and performance metrics, and exports the enriched records to NFO via NetFlow.

The recommended configuration method is Easy Performance Monitor (ezPM), which simplifies the setup to a small number of CLI commands compared to the traditional full-featured performance monitor configuration.

Prerequisites​

  • IOS XE: 3.10S or later
  • IOS: 15.4(1)T or later
  • Network connectivity: Router must reach the NFO IP on the configured UDP port (default: 9996)

Quick Configuration (CLI)​

Copy and adapt the following block to your device:

# Define the AVC context and destination
performance monitor context <CONTEXT_NAME> profile application-experience
  exporter destination <NFO_IP_ADDRESS> source <INTERFACE> port 9996

  # Enable specific monitors
  traffic-monitor application-response-time ipv4
  traffic-monitor conversation-traffic-stats ipv4
  traffic-monitor url ipv4
  traffic-monitor media ipv4
exit

# Apply to all active WAN interfaces
interface <INTERFACE_ID>
  performance monitor context <CONTEXT_NAME>
exit

IPv6 traffic: substitute ipv6 for ipv4 in any traffic-monitor line.

Reference Documentation​

For advanced traffic-monitor parameters and platform-specific limitations, refer to the official Cisco guides: