In this video, I'd like to walk you through the configuration of the
traditional flavor of NetFlow.
And it's only a few commands. It's pretty simple to do. And so for the
demonstration,
let's go ahead and take R2 and let's take its interface gig one zero and say we
want to do
caching of NetFlow information for any traffic that's going into that interface
, Ingress,
or traffic that's going out of that interface, egress. And syntax to set that
up is we go to
interface config on R2. We use the command IP flow space ingress for looking at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
interface config on R2. We use the command IP flow space ingress for looking at
inbound traffic
and then IP flow egress again on that same interface. And then it's going to
start caching
the traffic flows and all by itself, caching those traffic flows may not be too
effective
because we're not going to be able to see it unless we go to that router and
take a look.
So we'd also want to go ahead and specify where we want to export that to. So
let's imagine we
have a server over here at five dot five dot five dot five acting as a NetFlow
collector
using UDP port six seven eight three. So we'd also specify in our config IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
using UDP port six seven eight three. So we'd also specify in our config IP
flow dash export
and then destination I'll put DST for short space. And then the IP address five
five five five
along with the UDP port we want to use to put a space and six seven eight three
. And boom,
we have just configured the traditional flavor of NetFlow. That's now going to
be looking at
tracking traffic that's going inbound or outbound on this interface. And after
that cache timer
expires, it'll take that collected cached information and ship it over to that
server. So for this
quick demo, I don't have a server setup at five five five five, but we just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
quick demo, I don't have a server setup at five five five five, but we just
imagine that we do.
And again, at the router, the only three commands we need to do are these three
right here. So without
further ado, let's head over to R2 and let's enable NetFlow. So here in the lab
environment,
let me go ahead and double click on the topology to bring that up. Fantastic.
And we're going to
focus on R2. And then we bring that down just a little bit. And let's double
click here on server
one, which will give us access to all of our router console interfaces. So we
'll double click on server
one and give that a moment to come up. And here it comes, fantastic. And then
once it's up, we'll go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
once it's up, we'll go
to the tab here for R2. And on R2, we'll go into configuration mode. And first
let's do a do show
IP interface brief. And what we're going to do is we're going to focus on
tracking data in and
out of this interface, gig one zeros. So we'll get an interface gig one slash
zero, and we'll type
in the grand IP flow ingress and press enter and then IP flow egress and press
enter and boom.
Now it's willing to collect that information. Now at the moment, it's just
going to be storing
it to a local cache. So we'd also want to specify the export destination to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it to a local cache. So we'd also want to specify the export destination to the
collector's address.
So the command to that in traditional net flows IP flow dash export space and
the IP address of
our server, which is going to be 55555 and a space question mark. And I need to
actually say
the word destination. So it'll say destination space and then the IP address
55555 space question
mark. Then we can specify the port number as well. So we're going to use 6783.
Presuming the server
at the IP address is set up to listen on that port. And then we'll put in UDP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and press enter
and boom. So now if you do a do show run the word flow and press enter, we've
got the IP flow
ingress and egress on Internet is gig one zero and we have specified a
destination. So if we want to
see the cache we do show IP hash flow and press enter and currently here's the
flows that currently
sees and currently we have some flows. So we have traffic that source from 10
10 0 50 that happens
to be our little Windows 11 machine down here going to 23.1.2.100, which is our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to be our little Windows 11 machine down here going to 23.1.2.100, which is our
server in the upper right.
And the 11 here represents the protocol number. So this is in hexadecimal. So
11 in hex represents
16 plus one more, which is 17. That's UDP. So it's very likely DNS requests
going from this client
down here, client nug going up to the server. But we can also verify that we're
really tracking
the traffic going through the gig one zero interface here by sending some
additional traffic. So let's
go to client nug. That's our little Windows client machine in the upper right
hand corner. We'll
double click on that to open it up. And here it is. Let's open up a command WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
double click on that to open it up. And here it is. Let's open up a command
prompt here. And then
from here, let's go ahead and do a ping. Let's do a ping and a question mark.
And sorry too much
to just go up being by itself. And let's do a ping dash and four number. And
let's go ahead and
send 100. And let's go ahead and send it to the loop back address over on our
four. And that's
four dot four dot four dot four. So before I press enter here, if we go back to
our netflow
cached information, so go back to server one. And we hit the upper key into a
show IP cashflow.
We don't have any traffic that's destined to four dot four dot four dot four WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We don't have any traffic that's destined to four dot four dot four dot four
yet. So let's go back
to our Windows client machine. And we'll do the ping web processing enter and
away it goes. So those
pings are going. And now if we go back to the cached information on the router,
so go back to
server one. And here with the upper key into a show IP cashflow again, check it
out. Now we're
going to have some traffic going right there to four four four four and the
reply traffic coming
back from four four four back to 10 10 0 50 is right here. And so the protocol
number is one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
number is one.
That's the protocol number for IC and P which is used by ping. And it's also
giving us packet
counts. So we have the upper key and press enter and space bar. That packet
count should be increasing.
And the background that ping is going to go all the way up to a hundred. So if
we wait long enough,
we should see a hundred packets that are captured in netflow. So before we go
to the next section
and the next video, I start configuring the individual components for flexible
netflow.
I want to go ahead and clean this up so there's none of the existing
older netflow on our two. Let's do a show run type include flow, then we'll go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
older netflow on our two. Let's do a show run type include flow, then we'll go
to configuration
mode interface gig one slash zero. I'll say no for IP flow ingress and no for
IP flow egress
and also exit out of interface configuration mode to a no and we'll remove that
destination as well.
So currently we have no netflow in place on our two. So in the next video, that
's perfect because
I want to walk you through setting up the individual components for flexible
netflow,
which we'll do in the next video. So I'll see you there in just a moment.