Unable to get NetFlow flow in Cisco CSR1000v on AWS

Question

I'm trying to use NetFlow Traffic Analyzer of SolarWinds or any NetFlow Monitor in my Cisco CSR1000v routers which are deployed on AWS.

I am unable to see any NetFlow flows in the NetFlow Traffic Analyzer dashboard. I tracked down the flows using Wireshark, in which I couldn’t see any flows that go to the router which is deployed in AWS.

My assumption is that there are some settings need to be set on AWS. If the flows reached the server over the UDP port 2055, NetFlow Traffic Analyzer can show the information. I checked the Security group of my VPC, and all traffic is allowed in there.

I have found a topic which is about Configure AWS accounts for cloud monitoring about giving IAM permissions which must be configured in the AWS Management Console to provide access to the Orion Platform so it can collect status and metrics for AWS instances. However, it is still not working. I cannot see any NetFlow flows that coming from AWS to any NetFlow monitor.

Here is the configuration of Monitor, Exporter and Record:

flow monitor NTAMonitor
 exporter NTAExport
 cache timeout inactive 10
 cache timeout active 10
 record NTArecord

flow exporter NTAExport
 description exports to ELK
 destination 10.9.0.223
 source GigabitEthernet1
 transport udp 2055
 template data timeout 10
 option application-table timeout 10
 option application-attributes timeout 300

flow record NTArecord
 description basic traffic analysis in RTP
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 match transport source-port
 match transport destination-port
 match ipv4 tos
 match interface input
 collect interface output
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
 collect application name
 collect routing source as
 collect routing destination as

I did troubleshooting in order to make sure that the NetFlow is being sent from the router. Here are details of the Exporter:

ip-172-0-1-8#sh flow exporter 
Flow Exporter NTAExport:
  Description:              exports to ELK
  Export protocol:          NetFlow Version 9
  Transport Configuration:
    Destination IP address: 10.9.0.223
    Source IP address:      172.0.1.8
    Source Interface:       GigabitEthernet1
    Transport Protocol:     UDP
    Destination Port:       2055
    Source Port:            54240
    DSCP:                   0x0
    TTL:                    255
    Output Features:        Used
  Export template data timeout:        10
  Options Configuration:
    application-table (timeout 10 seconds) (active)
    application-attributes (timeout 300 seconds) (active)


ip-172-0-1-8#sh flow exporter statistics 
Flow Exporter NTAExport:
  Packet send statistics (last cleared 00:05:44 ago):
    Successfully sent:         3751                  (5028690 bytes)
    Reason not given:          20                    (1508 bytes)
    No destination address:    387                   (545303 bytes)

  Client send statistics:
    Client: Option options application-name
      Records added:           51415
        - sent:                49946
        - failed to send:      1469
      Bytes added:             4267445
        - sent:                4145518
        - failed to send:      121927

    Client: Option options application-attributes
      Records added:           2886
        - sent:                1443
        - failed to send:      1443
      Bytes added:             744588
        - sent:                372294
        - failed to send:      372294

    Client: Flow Monitor NTAMonitor
      Records added:           242
        - sent:                239
        - failed to send:      3
      Bytes added:             11132
        - sent:                10994
        - failed to send:      138

It seems there is NetFlow flow which is sent, but the NetFlow monitors are not able to catch it because of some AWS restrictions.

This is the policy I used which I have attached to all roles:

json{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "autoscaling:DescribeAutoScalingInstances",
                "ec2:DescribeInstances",
                "ec2:DescribeAddresses",
                "ec2:DescribeVolumeStatus",
                "ec2:TerminateInstances",
                "ec2:StartInstances",
                "autoscaling:DescribeAutoScalingGroups",
                "ec2:DescribeVolumes",
                "ec2:StopInstances",
                "cloudwatch:GetMetricStatistics"
            ],
            "Resource": "*"
        }
    ]
}