In this video, we're going to take
a look at Flexible NetFlow with version 9 and also version 10.
And the question that might come up
is, what makes it so flexible?
It's modular.
We're going to have separate objects
that we can use for records that identify
what we're trying to identify as traffic
goes through the network.
We're also going to have separate objects for monitors,
which identify which records we're tracking
and are applied to interfaces.
We're also going to have objects for exporters
that identify, where are we going to send this data?
Where are the collectors?
What are their IP addresses?
What ports are we going to use?
What protocol are we going to use? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What protocol are we going to use?
So it's modular.
So we can mix and match any we want to.
So for this discussion, what I'd like to do
is take you on some live gear and walk you
through from an interface perspective that
has a monitor applied.
And that way we can reverse engineer it,
and show you all the parts in a production network.
So as far as troubleshooting goes, if something isn't quite
going right, if you know how the pieces fit together,
like the monitor, and the records,
and the exporters, and that way, if it's not working,
we can identify what part's broken
and then fix it, and have functionality
again with NetFlow. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
again with NetFlow.
So here we go.
Let's start off with the interface.
Let's do a show run for interface gig 0/3.
So there's a lot of cool stuff going on here.
Let's focus on the parts that are relevant to NetFlow,
including right here it has two flow monitors that are applied.
So let's go ahead and put one of our objects up here
is flow monitor.
Now, in these flow monitors, which we'll take a look at here
in just a second, they are going to identify WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in just a second, they are going to identify
the types of records, the record object,
or what we're looking for as traffic is being
routed through this interface.
And it's also going to identify in the flow monitor
the exporter, which has the details on,
where do we send these records once they're cached?
And what protocol do we use?
So those are all embedded in the flow monitor.
So I think it'd be a good example if we just
took one of these.
Let's take SW-MON.
And this is applied inbound.
So any of the records that are specified by this monitor, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So any of the records that are specified by this monitor,
and any of the exporters that are identified by this monitor
are going to be used to be able to identify
data to collect, and then where to send it once it's received.
So our next stop is to take a look
at the details of this monitor object called SW-MON.
Let's do that now.
So let's do a show run.
And let's do a pipe.
And let's go ahead and do a section flow monitor.
Now, it's going to show us all the flow monitors.
And we'll just focus on the one called
SW-MON, which is right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
SW-MON, which is right here.
And so in this monitor object for NetFlow,
it's identifying an exporter.
So I'm going to make a note of that here.
I'll put a different color for that.
Let's say exporter.
And the name of that flow exporter
for this specific monitor is called SW-EXPORTER.
This monitor is also identifying the record object of SW_RECORD
right here.
So here's the play by play.
This flow monitor was applied to interface gig 0/3 inbound.
And that flow monitor called SW-MON identified WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that flow monitor called SW-MON identified
this exporter and this record.
And that's what we're looking at right here.
So let's continue to look at this exporter
object and this record object.
And the exporter is going to have
the details for who do we ship off this flow information to.
Where is the collector?
And the record object is going to identify
when we see traffic inbound on that interface what should we
pay attention to as far as flow information is concerned.
So to take a look at the exporter information,
we do a show run section flow. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we do a show run section flow.
And we'll type in export.
That'll be enough.
And here we go.
Looking at the exporter information, here it is.
So we're looking for the one called SW-EXPORT,
which is this guy right here.
So this is showing us the transport protocol of 2055 UDP.
It's also specifying the IP address of the collector,
that 172.20.30.201.
Fantastic.
It's also specifying the export protocol
of IP fix, which we can call version 10 affectionately. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of IP fix, which we can call version 10 affectionately.
Or if it said NetFlow version 9, then it'd be NetFlow version 9.
So this flow monitor called SW-MON identified
the exporter called SW-EXPORTER, which
we're looking at right here.
It also identified the record called SW_RECORD.
And that's indicating, when traffic shows up on gig 0/3,
what should it look for, what should it pay attention to
as it's recording flow information.
And that's going be detailed in this object
called the flow record called SW_RECORD.
Let's take a look at that next.
And we can do that with the Up Arrow. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we can do that with the Up Arrow.
Show run pipe section flow.
And we'll type in record, and press Enter.
And the one we are looking for is SW_RECORD.
And there it is right there.
So this flow record called SW_RECORD, which is right here,
this whole thing is identifying what we should pay attention
to, and what we should collect as far as flow information
when traffic shows up on that gig 0/3 interface.
Again, the big picture of tying it all together,
the flow monitor is applied to the interface.
In that flow monitor, it's going to refer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In that flow monitor, it's going to refer
to an exporter and a record.
The record objects says what we should pay attention to,
and the exporter object says where should we send it once
that information is collected.
So in troubleshooting, if we're not
getting the information we think,
we might want to verify that we have the correct flow
records identified.
And if we're not getting any data at the collector,
we'd want to make sure that we have the parameters set up
under the exporter object with the correct ports,
the correct IP address, make sure we have routing in place,
and that we don't have an axis control that's somewhere
between this router and the collector that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
between this router and the collector that
would be blocking that traffic from showing up
at the collector.
Now, one of the benefits of using NetFlow
is collecting this data at the collector
and then analyzing it with some software tool.
And that's what I'd like to give you
a demonstration of in the next video is that once
we have a bunch of devices that are collecting information,
forwarding it over to a collector, what
does that data look like?
Or what could it look like with a NetFlow analyzer?
So that's coming up in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.