Skip to main content
Version: Next

Application Enrichment: Cisco AVC

note

Enriched fields produced by this configuration are applied and available in the Network Conversations Module output.

Cisco Application Visibility and Control (AVC) is Cisco's application-awareness solution. Its classification engine, Network Based Application Recognition 2 (NBAR2), identifies applications using deep packet inspection on the device itself. When AVC is enabled, Cisco devices export the NBAR2 application in their flow records, giving NFO named, layer-7 visibility instead of port-based traffic analysis.

Supported Platforms​

PlatformConfiguration methodApplication data used by NFO
Routers: ISR 4000, Catalyst 8000 Edge (8200, 8300, 8500), Catalyst 8000V, ASR 1000Easy Performance Monitor (ezPM)Application
Switches: Catalyst 9000Wired AVC with Flexible NetFlowApplication
Catalyst SD-WAN edgesCflowd (IPFIX) with Application Visibility, from SD-WAN ManagerApplication
Meraki: MS390, Catalyst 9300-M, 9350-M, 9200-MMeraki Dashboard NetFlow (IPFIX)Application

Legacy IOS routers (ISR G2, IOS 15.4(1)T or later) are covered in Legacy Platforms below.

How It Works​

  1. Classification: NBAR2 on the device identifies the application for each flow.
  2. Export: The device exports flow records carrying the NBAR2 application ID (IPFIX field 95). Application names (field 96) are sent either in the flow record itself or in an options template that maps IDs to names.
  3. Name resolution: NFO builds its Application collector from the options template automatically, so application IDs resolve to names without manual mapping. See How NFO Resolves Application Names.
  4. Output: NFO reports app_id, app_name, app_desc, and app_engine_id in the Network Conversations Module output.

Cisco devices can also export other AVC data, such as Application Response Time (ART), URL, and application attributes (category, sub-category, business relevance). NFO does not report these today; support for application attributes is planned for a future release.

Prerequisites​

  • Routers: IOS XE 3.14S or later for the ezPM Application Performance profile
  • Network connectivity: The device must reach the NFO IP on the configured UDP port (default: 9996)

Routers: Easy Performance Monitor (ezPM)​

The Application Performance profile is Cisco's recommended ezPM profile for new configurations. It replaces the older Application Experience profile.

performance monitor context <CONTEXT_NAME> profile application-performance
  exporter destination <NFO_IP_ADDRESS> source <INTERFACE> port 9996
  traffic-monitor all
exit

# Apply to each WAN interface
interface <INTERFACE_ID>
  performance monitor context <CONTEXT_NAME>
exit

traffic-monitor all also enables monitors whose data NFO does not currently use, such as response time and URL. To reduce export volume, replace it with individual traffic-monitor lines; run traffic-monitor ? on the device to list the monitors available in your release.

Verify:

show performance monitor context <CONTEXT_NAME> exporter

Switches: Catalyst 9000 Wired AVC​

Catalyst 9000 switches do not use ezPM. Configure AVC with a Flexible NetFlow record that matches on application name, and export the application table as an option so NFO can resolve names.

flow record <RECORD_NAME>
  match ipv4 version
  match ipv4 protocol
  match application name
  match connection client ipv4 address
  match connection server ipv4 address
  match connection server transport port
  match flow observation point
  collect flow direction
  collect connection initiator
  collect connection new-connections
  collect connection client counter packets long
  collect connection client counter bytes network long
  collect connection server counter packets long
  collect connection server counter bytes network long
  collect timestamp absolute first
  collect timestamp absolute last
exit

flow exporter <EXPORTER_NAME>
  destination <NFO_IP_ADDRESS>
  source <INTERFACE>
  transport udp 9996
  export-protocol ipfix
  option application-table
exit

flow monitor <MONITOR_NAME>
  record <RECORD_NAME>
  exporter <EXPORTER_NAME>
exit

# Apply to each monitored port
interface <INTERFACE_ID>
  ip flow monitor <MONITOR_NAME> input
  ip flow monitor <MONITOR_NAME> output
exit

Wired AVC has platform-specific restrictions on supported interface types and on combining it with other flow monitors. Check the Cisco configuration guide for your switch model and release before deploying.

Catalyst SD-WAN​

Catalyst SD-WAN edges export flow records to external collectors using Cflowd, which is Cisco's implementation of IPFIX. The NBAR2 application ID is included only when Application Visibility is enabled. Application names reach NFO through the application-table options template.

  1. Enable Application Visibility. In SD-WAN Manager, create or edit a Localized Policy and check Application (and Application IPv6 if needed) under Policy Settings. From SD-WAN Manager Release 20.13, this setting is under Additional Settings. The CLI equivalent is app-visibility (and app-visibility-ipv6) under policy.
  2. Create a Cflowd policy. Under Centralized Policy, go to Traffic Policy > Cflowd and add a collector with the NFO IP address, UDP port 9996, the VPN through which the edge reaches NFO, and the source interface.
  3. Apply the policy to the sites whose traffic NFO should receive, and activate it.

Notes:

  • Edges export over UDP only, regardless of the transport selected in the template.
  • Up to four collectors can be configured per edge.
  • Cflowd monitors service-side traffic and exports ingress flows only.
  • On the edge, the active flow timeout is fixed at 60 seconds and the inactive timeout at 10 seconds.
caution

If flow visibility is enabled without application visibility, NBAR2 does not run, and the application exported to NFO may be missing or incorrect.

Verify:

show sdwan app-fwd cflowd collector
show sdwan app-fwd cflowd statistics

Meraki Catalyst-Based Switches​

Meraki MS390, Catalyst 9300-M, 9350-M, and 9200-M switches export NBAR2 application data over IPFIX.

Prerequisites:

  • CS 15 or later, or cloud-native IOS XE 17.15 or later
  • Meraki Advanced license
  • An L3 SVI on the exporting switch or stack, reachable to NFO (created by default on cloud-native IOS XE 17.15 or later)

Configuration:

  1. In the Meraki Dashboard, go to Network-wide > General.
  2. Enter the NFO IP address and UDP port as the NetFlow collector.
  3. For switches running cloud-native IOS XE 17.15 or later, set Traffic analytics to Detailed. Flow export does not occur otherwise.

Meraki supports one flow exporter per network, and the flow record format is fixed. Catalyst 9500, 9400, and 9600 switches managed by Meraki export NetFlow but not application data.

Legacy Platforms​

ISR G2 routers (IOS 15.4(1)T or later) and IOS XE releases earlier than 3.14S support only the legacy Application Experience ezPM profile:

performance monitor context <CONTEXT_NAME> profile application-experience
  exporter destination <NFO_IP_ADDRESS> source <INTERFACE> port 9996
  traffic-monitor conversation-traffic-stats ipv4
exit

interface <INTERFACE_ID>
  performance monitor context <CONTEXT_NAME>
exit

IPv6 traffic: add traffic-monitor conversation-traffic-stats ipv6.

Reference Documentation​