WEBVTT 1 00:00.000 --> 00:03.840 In preparation for setting up Flexible Netflow here on R2, 2 00:03.840 --> 00:05.480 let's put a game plan together. 3 00:05.480 --> 00:08.360 We're going to need to create a flow record. 4 00:08.360 --> 00:10.680 As a reminder, the record that we're going to create, 5 00:10.680 --> 00:13.080 it identifies what we're going to match a flow on. 6 00:13.080 --> 00:15.720 That can include things like source IP and 7 00:15.720 --> 00:19.320 destination IP and the layer for protocol that's being used. 8 00:19.320 --> 00:25.120 For example, ICMP or TCP or UDP or GRE or IPsec, etc. 9 00:25.120 --> 00:28.080 These are the example of key fields that we're going to 10 00:28.080 --> 00:30.680 match on regarding identifying a flow of traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:28.080 --> 00:30.680 match on regarding identifying a flow of traffic. 11 00:30.680 --> 00:33.720 Then additionally, we can say once we've identified those flows, 12 00:33.720 --> 00:37.240 we can also collect additional data on those flows. 13 00:37.240 --> 00:40.240 Things like number of packets and more. 14 00:40.240 --> 00:43.680 Our first step in setting up Flexible Netflow is to create 15 00:43.680 --> 00:46.360 our own customized user defined record. 16 00:46.360 --> 00:50.360 Now, there also are some predefined records that we can use if we want to. 17 00:50.360 --> 00:52.720 But I'm going to walk you through in this video how we can create 18 00:52.720 --> 00:56.720 our own customized record that's going to identify what we want to match on 19 00:56.720 --> 00:57.760 and what we want to collect. 20 00:57.760 --> 01:02.430 So let's head over to R2 and create our own Flexible Netflow user defined WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 20 00:57.760 --> 01:02.430 So let's head over to R2 and create our own Flexible Netflow user defined 21 01:02.430 --> 01:02.960 record. 22 01:02.960 --> 01:05.800 So the first step to configuring a new flow record, 23 01:05.800 --> 01:08.400 user defined flow record on R2 is to make sure on the right router. 24 01:08.400 --> 01:13.480 So here we are R2 and it's also a show flow record press center. 25 01:13.480 --> 01:15.360 And there are no show flow records. 26 01:15.360 --> 01:17.440 There's a DL so there that is implied. 27 01:17.440 --> 01:18.000 Fantastic. 28 01:18.000 --> 01:22.640 So let's go into configuration mode by typing in config T and typing in flow 29 01:22.640 --> 01:23.400 record. 30 01:23.400 --> 01:24.920 And then let's go ahead and create what? 31 01:24.920 --> 01:28.480 Let's call this our dash flow dash record. 32 01:28.480 --> 01:30.200 You can name it pretty much whatever you want. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 32 01:28.480 --> 01:30.200 You can name it pretty much whatever you want. 33 01:30.200 --> 01:31.520 We'll name it this week when we see it. 34 01:31.520 --> 01:32.960 We'll know exactly what it is. 35 01:32.960 --> 01:36.000 And now we're in flow record configuration mode. 36 01:36.000 --> 01:38.520 So if we do a question mark, we have a couple options. 37 01:38.520 --> 01:42.600 We have a match option, which identifies what we're going to match on to 38 01:42.600 --> 01:44.200 identify a flow of traffic. 39 01:44.200 --> 01:47.680 And those are referred to as a key field for identifying the flow. 40 01:47.680 --> 01:50.660 And then secondly, we can use the collect option, which is looking at 41 01:50.660 --> 01:51.480 additional information 42 01:51.480 --> 01:53.280 you want to collect about those flows. 43 01:53.280 --> 01:55.600 And those are referred to as non key fields. 44 01:55.600 --> 01:58.800 So the key fields are what we're matching on regarding a flow. 45 01:58.800 --> 02:01.320 And the non key fields think of it like extra information we're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 45 01:58.800 --> 02:01.320 And the non key fields think of it like extra information we're going to 46 02:01.320 --> 02:02.800 collect about those flows. 47 02:02.800 --> 02:04.120 So let's start with the match. 48 02:04.120 --> 02:05.760 So let's say match space question mark. 49 02:05.760 --> 02:10.080 Let's go ahead and match on IPV4 and space question mark. 50 02:10.080 --> 02:11.920 And listen so much to match on. 51 02:11.920 --> 02:15.040 Let's match on source IP address. 52 02:15.040 --> 02:19.520 First of all, so we'll type in source space address and we'll press center. 53 02:19.520 --> 02:22.400 And then as a second consideration for a flow, 54 02:22.400 --> 02:26.240 let's also go ahead and match a nice IPV4 destination address. 55 02:26.240 --> 02:31.390 Instead of do show flow records, we have so far and we have these two fields WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 02:26.240 --> 02:31.390 Instead of do show flow records, we have so far and we have these two fields 56 02:31.390 --> 02:32.640 regarding matching. 57 02:32.640 --> 02:34.280 And right here, it says number of users. 58 02:34.280 --> 02:36.280 That means we haven't applied this anywhere yet. 59 02:36.280 --> 02:38.960 We're not using this net flow record. 60 02:38.960 --> 02:40.160 Let's do another match as well. 61 02:40.160 --> 02:45.040 It's going to match on as to a match on IPV4, base question mark. 62 02:45.040 --> 02:46.480 And let's go ahead and do protocol. 63 02:46.480 --> 02:49.330 And as you can see, there's a lot of other options we could use regarding what 64 02:49.330 --> 02:51.560 we want to match on to consider a flow of traffic. 65 02:51.560 --> 02:52.760 So now we've done some matches. 66 02:52.760 --> 02:55.720 Let's go ahead and use the next option of collect. 67 02:55.720 --> 02:59.720 Again, tons of options here for collecting information about those flows. 68 02:59.720 --> 03:03.880 So we could go ahead and say application name, space question mark. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 68 02:59.720 --> 03:03.880 So we could go ahead and say application name, space question mark. 69 03:03.880 --> 03:07.940 So we do collect application name and let's do a collect and space question 70 03:07.940 --> 03:08.280 mark. 71 03:08.280 --> 03:11.160 Let's go ahead and do IPV4 space question mark. 72 03:11.160 --> 03:15.020 And let's go ahead and include TOS, the type of service bits in the IP header 73 03:15.020 --> 03:15.760 and enter. 74 03:15.760 --> 03:19.360 And as part of those flows, let's also go ahead and collect the TTL as well. 75 03:19.360 --> 03:22.080 So collect IPV4, TTL. 76 03:22.080 --> 03:25.920 If we do a do show flow record, it'll show us what we have so far. 77 03:25.920 --> 03:29.690 So the match portions are what we're going to look for as identifying a flow of 78 03:29.690 --> 03:30.240 traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 78 03:29.690 --> 03:30.240 traffic. 79 03:30.240 --> 03:33.240 And then regarding those flows of traffic that are matched, we are going to 80 03:33.240 --> 03:37.340 collect information regarding the type of service bits, the TTL and also the 81 03:37.340 --> 03:38.360 application name. 82 03:38.360 --> 03:41.120 So from our overview, we talked about three components. 83 03:41.120 --> 03:44.640 We have a record, which we just made, a new flow record that's user defined. 84 03:44.640 --> 03:48.030 Additionally, we're going to need to create an object for the exporter that has 85 03:48.030 --> 03:51.680 the details about who to send this cached information to. 86 03:51.680 --> 03:55.360 And then our third step is going to create a monitor, which is going to 87 03:55.360 --> 03:58.080 identify which exporter and which records to use. 88 03:58.080 --> 04:01.980 And also as part of the monitor, we'll specify which interface or interfaces we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 88 03:58.080 --> 04:01.980 And also as part of the monitor, we'll specify which interface or interfaces we 89 04:01.980 --> 04:03.800 want to collect that information on. 90 04:03.800 --> 04:06.920 So in the next video, let's create the exporter, which is simply going to 91 04:06.920 --> 04:11.950 identify which server we're going to ship this cached information to and what 92 04:11.950 --> 04:14.600 protocol reports we should use when shipping that information. 93 04:14.600 --> 04:19.320 So I'll see you in the next video as we begin to configure a flexible net flow 94 04:19.320 --> 04:19.800 exporter.