All right, my friend, it's time to get some hands
on with some NetFlow.
So let me introduce the topology.
If you are logged on to the CBT Nuggets website,
click on the link for the Virtual lab,
and let's configure and verify NetFlow together.
And because we're going to start with NetFlow version 5,
it's very simple to configure.
We're going to go into interface configuration mode.
And let's do it on R1.
And we'll simply tell it to pay attention
to traffic that's going out that interface and also traffic
going in that interface.
And then we probably want to generate some traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we probably want to generate some traffic.
So to generate traffic, let's go to R7.
And on R7, we can just do a telnet session to R8.
And that'll give us enough information
to go ahead and see the flow in the cache.
We can also define a collector, although I don't have
a collector in the topology.
We'll go ahead and use a collector
at address 1.2.3.4, UDP port--
let's do 6783.
All right, so here we go.
Well, I'm just going to do a show IP interface brief,
just to make sure I'm on the right interfaces. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just to make sure I'm on the right interfaces.
And let's go ahead and play with gig 1/0.
And we'll do outbound and inbound, telling it to cache,
or gather in, the flow information we're getting,
traffic going out or in on that interface.
So to do that, we'll go into configuration mode.
And interface gig, make sure I get the right one--
1/0.
Fantastic.
IP flow is the syntax.
And we'll just say ingress for traffic coming in
on that interface.
And we'll also do egress as well.
So next, let's specify where--
when we get this information, we collect this information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
when we get this information, we collect this information
that flows-- where it should send it.
So we'll exit out of configuration mode.
We'll do IP flow and a question mark.
And we want flow-export.
And so IP flow-export, destination
is going to be that.
1.2.3.4, which is the IP address of the server who's
going to be listening for us.
And-- it says you weren't done.
And the UDP port number.
We'll use 6783.
And we can also specify an IP flow-export.
We can also specify the source. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can also specify the source.
If we want to source this from our loopback 0,
we can do that as well.
So we'll do loopback 0 as our source address.
Not required, but certainly an option.
And we should also specify what version for the export.
And here we have options for 1, 5, and 9.
And we're going to say 5 here because that's
the version we're going to use.
But even if we said 9, that's just for the export function.
That doesn't make it Flexible NetFlow
because we're not creating the monitor, or the exporter,
or the record objects, as we will with Flexible NetFlow. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or the record objects, as we will with Flexible NetFlow.
So here, we're going to use version 5.
And we are done.
Let's take a look at some show commands.
Let's do a show IP cache flow and press Enter.
And it's saying that there's not a whole bunch of data
here yet cached.
And that's because we don't have traffic that's
flowing through our router yet.
So this is showing us a packet-sized distribution.
And down here, there's just nothing
in the cache at the moment.
So let's put something in the cache that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's put something in the cache that
has something to work with.
And to do that, let's go to R7.
And let's telnet over to R8.
R8 is at 10.2--
look at this IP address.
This will do.
We'll look at this IP address, then we'll telnet to it.
Let's go to R8 and do a show IP interface brief.
And I know that the one that's reachable is 10.2.68.8.
I'm just going to copy that and go back to R7 and do a ping.
Just go ahead and telnet there.
And we'll put the address in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll put the address in.
Great.
So now we're connected to R8.
So if we generate some traffic--
show run.
Hit spacebar a few times.
That's generating some traffic.
That's definitely-- that flow information is recorded.
And let's go back to R1.
And we'll hit the up arrow key.
Show IP cash flow.
And it should show us that information.
So it has some packet distribution information
up above.
It's also showing us right here on these interfaces
about source address and destination
address, protocol numbers, and also packets involved. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address, protocol numbers, and also packets involved.
Fantastic.
So what this device is going to do periodically,
it's going to ship this information from its cache
and ship it over to the NetFlow Collector
and then forget about it locally.
Now, if we had a collector sitting there,
it would collect all that information
from all the devices.
Then we could use the NetFlow Analyzer
to analyze all the data and make the pretty graphs for us.
This is a basic example of setting up
NetFlow version 5 old school before we
get into the modular components, which is coming up.
So thanks for joining me in this video and lab,
and I'll see you in the next video. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'll see you in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.