WEBVTT

1
00:00.000 --> 00:03.140
In this video, I'd like to walk you through the configuration of the

2
00:03.140 --> 00:05.280
traditional flavor of NetFlow.

3
00:05.280 --> 00:08.720
And it's only a few commands. It's pretty simple to do. And so for the

4
00:08.720 --> 00:09.280
demonstration,

5
00:09.280 --> 00:13.300
let's go ahead and take R2 and let's take its interface gig one zero and say we

6
00:13.300 --> 00:14.240
want to do

7
00:14.240 --> 00:18.230
caching of NetFlow information for any traffic that's going into that interface

8
00:18.230 --> 00:19.040
, Ingress,

9
00:19.040 --> 00:23.840
or traffic that's going out of that interface, egress. And syntax to set that

10
00:23.840 --> 00:24.400
up is we go to

11
00:24.400 --> 00:30.210
interface config on R2. We use the command IP flow space ingress for looking at
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:24.400 --> 00:30.210
interface config on R2. We use the command IP flow space ingress for looking at

12
00:30.210 --> 00:31.280
inbound traffic

13
00:31.280 --> 00:36.850
and then IP flow egress again on that same interface. And then it's going to

14
00:36.850 --> 00:38.000
start caching

15
00:38.000 --> 00:42.050
the traffic flows and all by itself, caching those traffic flows may not be too

16
00:42.050 --> 00:42.640
effective

17
00:42.640 --> 00:45.080
because we're not going to be able to see it unless we go to that router and

18
00:45.080 --> 00:45.680
take a look.

19
00:45.680 --> 00:49.440
So we'd also want to go ahead and specify where we want to export that to. So

20
00:49.440 --> 00:49.840
let's imagine we

21
00:49.840 --> 00:55.360
have a server over here at five dot five dot five dot five acting as a NetFlow

22
00:55.360 --> 00:56.080
collector

23
00:56.080 --> 01:00.960
using UDP port six seven eight three. So we'd also specify in our config IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:56.080 --> 01:00.960
using UDP port six seven eight three. So we'd also specify in our config IP

24
01:00.960 --> 01:02.320
flow dash export

25
01:02.320 --> 01:06.800
and then destination I'll put DST for short space. And then the IP address five

26
01:06.800 --> 01:08.000
five five five

27
01:08.000 --> 01:12.780
along with the UDP port we want to use to put a space and six seven eight three

28
01:12.780 --> 01:13.520
. And boom,

29
01:13.520 --> 01:17.760
we have just configured the traditional flavor of NetFlow. That's now going to

30
01:17.760 --> 01:18.400
be looking at

31
01:18.400 --> 01:22.550
tracking traffic that's going inbound or outbound on this interface. And after

32
01:22.550 --> 01:23.360
that cache timer

33
01:23.360 --> 01:27.260
expires, it'll take that collected cached information and ship it over to that

34
01:27.260 --> 01:28.560
server. So for this

35
01:28.560 --> 01:31.670
quick demo, I don't have a server setup at five five five five, but we just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.560 --> 01:31.670
quick demo, I don't have a server setup at five five five five, but we just

36
01:31.670 --> 01:32.880
imagine that we do.

37
01:32.880 --> 01:36.250
And again, at the router, the only three commands we need to do are these three

38
01:36.250 --> 01:37.120
right here. So without

39
01:37.120 --> 01:40.740
further ado, let's head over to R2 and let's enable NetFlow. So here in the lab

40
01:40.740 --> 01:41.440
environment,

41
01:41.440 --> 01:44.820
let me go ahead and double click on the topology to bring that up. Fantastic.

42
01:44.820 --> 01:45.200
And we're going to

43
01:45.200 --> 01:48.590
focus on R2. And then we bring that down just a little bit. And let's double

44
01:48.590 --> 01:49.680
click here on server

45
01:49.680 --> 01:53.280
one, which will give us access to all of our router console interfaces. So we

46
01:53.280 --> 01:54.560
'll double click on server

47
01:54.560 --> 01:59.710
one and give that a moment to come up. And here it comes, fantastic. And then

48
01:59.710 --> 02:00.880
once it's up, we'll go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.710 --> 02:00.880
once it's up, we'll go

49
02:00.880 --> 02:05.400
to the tab here for R2. And on R2, we'll go into configuration mode. And first

50
02:05.400 --> 02:06.640
let's do a do show

51
02:06.640 --> 02:10.300
IP interface brief. And what we're going to do is we're going to focus on

52
02:10.300 --> 02:11.680
tracking data in and

53
02:11.680 --> 02:15.380
out of this interface, gig one zeros. So we'll get an interface gig one slash

54
02:15.380 --> 02:16.080
zero, and we'll type

55
02:16.080 --> 02:21.780
in the grand IP flow ingress and press enter and then IP flow egress and press

56
02:21.780 --> 02:23.280
enter and boom.

57
02:23.280 --> 02:26.540
Now it's willing to collect that information. Now at the moment, it's just

58
02:26.540 --> 02:27.120
going to be storing

59
02:27.120 --> 02:31.270
it to a local cache. So we'd also want to specify the export destination to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:27.120 --> 02:31.270
it to a local cache. So we'd also want to specify the export destination to the

60
02:31.270 --> 02:32.560
collector's address.

61
02:32.560 --> 02:37.960
So the command to that in traditional net flows IP flow dash export space and

62
02:37.960 --> 02:38.640
the IP address of

63
02:38.640 --> 02:44.010
our server, which is going to be 55555 and a space question mark. And I need to

64
02:44.010 --> 02:44.800
actually say

65
02:44.800 --> 02:49.040
the word destination. So it'll say destination space and then the IP address

66
02:49.040 --> 02:50.720
55555 space question

67
02:50.720 --> 02:54.920
mark. Then we can specify the port number as well. So we're going to use 6783.

68
02:54.920 --> 02:55.840
Presuming the server

69
02:55.840 --> 03:00.000
at the IP address is set up to listen on that port. And then we'll put in UDP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:00.000 --> 03:00.960
and press enter

71
03:00.960 --> 03:05.280
and boom. So now if you do a do show run the word flow and press enter, we've

72
03:05.280 --> 03:06.240
got the IP flow

73
03:06.240 --> 03:10.020
ingress and egress on Internet is gig one zero and we have specified a

74
03:10.020 --> 03:11.520
destination. So if we want to

75
03:11.520 --> 03:16.410
see the cache we do show IP hash flow and press enter and currently here's the

76
03:16.410 --> 03:17.360
flows that currently

77
03:17.360 --> 03:21.620
sees and currently we have some flows. So we have traffic that source from 10

78
03:21.620 --> 03:23.280
10 0 50 that happens

79
03:23.280 --> 03:30.170
to be our little Windows 11 machine down here going to 23.1.2.100, which is our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:23.280 --> 03:30.170
to be our little Windows 11 machine down here going to 23.1.2.100, which is our

80
03:30.170 --> 03:31.680
server in the upper right.

81
03:31.680 --> 03:36.320
And the 11 here represents the protocol number. So this is in hexadecimal. So

82
03:36.320 --> 03:38.240
11 in hex represents

83
03:38.240 --> 03:43.400
16 plus one more, which is 17. That's UDP. So it's very likely DNS requests

84
03:43.400 --> 03:44.880
going from this client

85
03:44.880 --> 03:48.620
down here, client nug going up to the server. But we can also verify that we're

86
03:48.620 --> 03:49.600
really tracking

87
03:49.600 --> 03:52.650
the traffic going through the gig one zero interface here by sending some

88
03:52.650 --> 03:53.840
additional traffic. So let's

89
03:53.840 --> 03:57.010
go to client nug. That's our little Windows client machine in the upper right

90
03:57.010 --> 03:57.680
hand corner. We'll

91
03:57.680 --> 04:00.960
double click on that to open it up. And here it is. Let's open up a command
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:57.680 --> 04:00.960
double click on that to open it up. And here it is. Let's open up a command

92
04:00.960 --> 04:01.840
prompt here. And then

93
04:01.840 --> 04:06.470
from here, let's go ahead and do a ping. Let's do a ping and a question mark.

94
04:06.470 --> 04:08.240
And sorry too much

95
04:08.240 --> 04:13.390
to just go up being by itself. And let's do a ping dash and four number. And

96
04:13.390 --> 04:14.320
let's go ahead and

97
04:14.320 --> 04:18.410
send 100. And let's go ahead and send it to the loop back address over on our

98
04:18.410 --> 04:19.440
four. And that's

99
04:19.440 --> 04:23.110
four dot four dot four dot four. So before I press enter here, if we go back to

100
04:23.110 --> 04:23.840
our netflow

101
04:23.840 --> 04:27.780
cached information, so go back to server one. And we hit the upper key into a

102
04:27.780 --> 04:29.200
show IP cashflow.

103
04:29.200 --> 04:33.640
We don't have any traffic that's destined to four dot four dot four dot four
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
04:29.200 --> 04:33.640
We don't have any traffic that's destined to four dot four dot four dot four

104
04:33.640 --> 04:35.040
yet. So let's go back

105
04:35.040 --> 04:38.940
to our Windows client machine. And we'll do the ping web processing enter and

106
04:38.940 --> 04:39.760
away it goes. So those

107
04:39.760 --> 04:43.430
pings are going. And now if we go back to the cached information on the router,

108
04:43.430 --> 04:44.160
so go back to

109
04:44.160 --> 04:49.040
server one. And here with the upper key into a show IP cashflow again, check it

110
04:49.040 --> 04:50.000
out. Now we're

111
04:50.000 --> 04:53.660
going to have some traffic going right there to four four four four and the

112
04:53.660 --> 04:54.720
reply traffic coming

113
04:54.720 --> 04:59.140
back from four four four back to 10 10 0 50 is right here. And so the protocol

114
04:59.140 --> 05:00.160
number is one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:59.140 --> 05:00.160
number is one.

115
05:00.160 --> 05:03.390
That's the protocol number for IC and P which is used by ping. And it's also

116
05:03.390 --> 05:04.240
giving us packet

117
05:04.240 --> 05:07.700
counts. So we have the upper key and press enter and space bar. That packet

118
05:07.700 --> 05:09.440
count should be increasing.

119
05:09.440 --> 05:12.630
And the background that ping is going to go all the way up to a hundred. So if

120
05:12.630 --> 05:13.840
we wait long enough,

121
05:13.840 --> 05:17.610
we should see a hundred packets that are captured in netflow. So before we go

122
05:17.610 --> 05:18.800
to the next section

123
05:18.800 --> 05:22.360
and the next video, I start configuring the individual components for flexible

124
05:22.360 --> 05:23.040
netflow.

125
05:23.040 --> 05:26.320
I want to go ahead and clean this up so there's none of the existing

126
05:26.320 --> 05:31.510
older netflow on our two. Let's do a show run type include flow, then we'll go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
05:26.320 --> 05:31.510
older netflow on our two. Let's do a show run type include flow, then we'll go

127
05:31.510 --> 05:32.160
to configuration

128
05:32.160 --> 05:38.280
mode interface gig one slash zero. I'll say no for IP flow ingress and no for

129
05:38.280 --> 05:39.680
IP flow egress

130
05:39.680 --> 05:43.750
and also exit out of interface configuration mode to a no and we'll remove that

131
05:43.750 --> 05:44.880
destination as well.

132
05:47.200 --> 05:51.770
So currently we have no netflow in place on our two. So in the next video, that

133
05:51.770 --> 05:52.320
's perfect because

134
05:52.320 --> 05:56.160
I want to walk you through setting up the individual components for flexible

135
05:56.160 --> 05:56.640
netflow,

136
05:56.640 --> 06:03.120
which we'll do in the next video. So I'll see you there in just a moment.