In preparation for setting up Flexible Netflow here on R2,
let's put a game plan together.
We're going to need to create a flow record.
As a reminder, the record that we're going to create,
it identifies what we're going to match a flow on.
That can include things like source IP and
destination IP and the layer for protocol that's being used.
For example, ICMP or TCP or UDP or GRE or IPsec, etc.
These are the example of key fields that we're going to
match on regarding identifying a flow of traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
match on regarding identifying a flow of traffic.
Then additionally, we can say once we've identified those flows,
we can also collect additional data on those flows.
Things like number of packets and more.
Our first step in setting up Flexible Netflow is to create
our own customized user defined record.
Now, there also are some predefined records that we can use if we want to.
But I'm going to walk you through in this video how we can create
our own customized record that's going to identify what we want to match on
and what we want to collect.
So let's head over to R2 and create our own Flexible Netflow user defined WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's head over to R2 and create our own Flexible Netflow user defined
record.
So the first step to configuring a new flow record,
user defined flow record on R2 is to make sure on the right router.
So here we are R2 and it's also a show flow record press center.
And there are no show flow records.
There's a DL so there that is implied.
Fantastic.
So let's go into configuration mode by typing in config T and typing in flow
record.
And then let's go ahead and create what?
Let's call this our dash flow dash record.
You can name it pretty much whatever you want. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
You can name it pretty much whatever you want.
We'll name it this week when we see it.
We'll know exactly what it is.
And now we're in flow record configuration mode.
So if we do a question mark, we have a couple options.
We have a match option, which identifies what we're going to match on to
identify a flow of traffic.
And those are referred to as a key field for identifying the flow.
And then secondly, we can use the collect option, which is looking at
additional information
you want to collect about those flows.
And those are referred to as non key fields.
So the key fields are what we're matching on regarding a flow.
And the non key fields think of it like extra information we're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the non key fields think of it like extra information we're going to
collect about those flows.
So let's start with the match.
So let's say match space question mark.
Let's go ahead and match on IPV4 and space question mark.
And listen so much to match on.
Let's match on source IP address.
First of all, so we'll type in source space address and we'll press center.
And then as a second consideration for a flow,
let's also go ahead and match a nice IPV4 destination address.
Instead of do show flow records, we have so far and we have these two fields WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Instead of do show flow records, we have so far and we have these two fields
regarding matching.
And right here, it says number of users.
That means we haven't applied this anywhere yet.
We're not using this net flow record.
Let's do another match as well.
It's going to match on as to a match on IPV4, base question mark.
And let's go ahead and do protocol.
And as you can see, there's a lot of other options we could use regarding what
we want to match on to consider a flow of traffic.
So now we've done some matches.
Let's go ahead and use the next option of collect.
Again, tons of options here for collecting information about those flows.
So we could go ahead and say application name, space question mark. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we could go ahead and say application name, space question mark.
So we do collect application name and let's do a collect and space question
mark.
Let's go ahead and do IPV4 space question mark.
And let's go ahead and include TOS, the type of service bits in the IP header
and enter.
And as part of those flows, let's also go ahead and collect the TTL as well.
So collect IPV4, TTL.
If we do a do show flow record, it'll show us what we have so far.
So the match portions are what we're going to look for as identifying a flow of
traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
traffic.
And then regarding those flows of traffic that are matched, we are going to
collect information regarding the type of service bits, the TTL and also the
application name.
So from our overview, we talked about three components.
We have a record, which we just made, a new flow record that's user defined.
Additionally, we're going to need to create an object for the exporter that has
the details about who to send this cached information to.
And then our third step is going to create a monitor, which is going to
identify which exporter and which records to use.
And also as part of the monitor, we'll specify which interface or interfaces we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And also as part of the monitor, we'll specify which interface or interfaces we
want to collect that information on.
So in the next video, let's create the exporter, which is simply going to
identify which server we're going to ship this cached information to and what
protocol reports we should use when shipping that information.
So I'll see you in the next video as we begin to configure a flexible net flow
exporter.