Netforge.ai Docs
Open the app →
Docs/Guide/Device Configuration/Features (ACL/QoS/NetFlow)

Features (ACL/QoS/NetFlow)

Relevant for:Professional ServicesEnterprise / NetOps
Where to find itCanvas→Select a device→Features tab

Features are named objects defined once and bound where needed: ACLs and QoS policies bind to interfaces; prefix-lists and route-maps bind to BGP neighbors and to each other; NetFlow monitors bind to interfaces. Validation flags any binding whose object doesn't exist.

ACLs, prefix-lists & route-maps#

ip access-list extended EDGE-IN
permit tcp any 10.10.10.0/24 eq 443
!
ip prefix-list PL-DEFAULT permit 0.0.0.0/0
route-map RM-IN permit 10
 match ip address prefix-list PL-DEFAULT
 set local-preference 200
Why
Prefix-lists — not ACLs — are the right tool for route filtering: they match on prefix length ranges (ge/le) and are evaluated more efficiently. Route-maps then attach policy (local-pref, MED, communities) to what matched. Netforge.ai keeps the reference chain honest: a route-map that matches an undefined prefix-list is flagged before it ever hits a device.

NetFlow / IPFIX#

A flow monitor defines the collector (destination, UDP port, version), export source interface, template timeout, and cache timeouts; bind it per interface (input/output) on the Interfaces tab.

flow exporter NF-exp
 destination 10.9.9.9
 source Loopback0
 transport udp 2055
 export-protocol netflow-v9
 template data timeout 30
flow monitor NF
 record NF-record
 exporter NF-exp
 cache timeout active 60
 cache timeout inactive 15
Why
Exporting from a loopback keeps the collector's view of the device stable across path changes; a 60/15-second active/inactive cache gives near-real-time visibility instead of the default 30-minute aggregation. Validation warns when a monitor has no collector — a silent black hole otherwise.

QoS policies#

Class-maps match DSCP/CoS values or ACLs; the policy sets markings, polices, priorities, or bandwidth shares, and binds to interfaces as a service-policy.