WEBVTT

1
00:00.000 --> 00:04.440
In the previous video, we created a flow record, and that flow record when it's

2
00:04.440 --> 00:05.520
used is going to be

3
00:05.520 --> 00:12.600
matching on the IPv4 source and destination IP addresses as well as the IPv4

4
00:12.600 --> 00:14.160
protocol in use.

5
00:14.160 --> 00:17.040
And then in addition to that match that we did in the previous video, we also

6
00:17.040 --> 00:17.520
said regarding those

7
00:17.520 --> 00:21.410
flows, let's go ahead and collect additional information regarding IPv4 type of

8
00:21.410 --> 00:22.480
service bits

9
00:22.480 --> 00:26.560
and the TTL and the application. There's one of the cool things about NetFlow

10
00:26.560 --> 00:27.040
is we can pretty

11
00:27.040 --> 00:30.780
much pick and choose almost anything from layer two all the way up to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:27.040 --> 00:30.780
much pick and choose almost anything from layer two all the way up to the

12
00:30.780 --> 00:31.920
application layer that

13
00:31.920 --> 00:35.800
we wanted to collect about our existing flows. So our next step then is to go

14
00:35.800 --> 00:36.640
ahead and create

15
00:36.640 --> 00:39.990
an exporter. And as we talked about in the previous video, what we're going to

16
00:39.990 --> 00:40.720
do is take the day

17
00:40.720 --> 00:43.610
that we cache here locally, and we're going to send it over to the IP address

18
00:43.610 --> 00:47.040
23.1.2.100 on port 9996,

19
00:47.040 --> 00:50.830
because that's where that server has been configured to listen for incoming Net

20
00:50.830 --> 00:50.960
Flow.

21
00:50.960 --> 00:54.540
And to configure that, we'll do it under the exporter. We're also going to

22
00:54.540 --> 00:55.360
specify we're going to

23
00:55.360 --> 01:00.080
source that traffic from the loopback zero interface here in R2, which is 2222.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:55.360 --> 01:00.080
source that traffic from the loopback zero interface here in R2, which is 2222.

24
01:00.080 --> 01:01.520
So the server is already

25
01:01.520 --> 01:05.880
set up expecting to receive NetFlow traffic on this port from the source

26
01:05.880 --> 01:08.560
address of 2222 here on R2.

27
01:08.560 --> 01:12.810
So let's go to R2 and create the flexible NetFlow entity of the exporter. So

28
01:12.810 --> 01:14.160
here in R2, let's confirm

29
01:14.160 --> 01:17.340
the flow record we created in the previous video. And we can do that with a

30
01:17.340 --> 01:18.560
show flow record.

31
01:18.560 --> 01:22.820
And there it is in all of us glory. Next, let's create our flow exporter. Now,

32
01:22.820 --> 01:23.840
just to verify us to do

33
01:23.840 --> 01:28.090
show flow exporter and press enter, and we don't have one. Great, great, great.

34
01:28.090 --> 01:28.400
So let's go ahead

35
01:28.400 --> 01:33.660
and create one to do that. We'll type in flow exporter and let's name this our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.400 --> 01:33.660
and create one to do that. We'll type in flow exporter and let's name this our

36
01:33.660 --> 01:35.600
flow dash exporter.

37
01:35.600 --> 01:39.380
And then we're in flow exporter configuration mode. And so if we do a question

38
01:39.380 --> 01:39.840
mark here,

39
01:39.840 --> 01:43.190
let's specify first of all the destination of the server, the collector that's

40
01:43.190 --> 01:44.080
expecting to receive

41
01:44.080 --> 01:47.770
this cached information. So we'll type in destination, the address of our

42
01:47.770 --> 01:51.280
server, which is 23.1.2.100.

43
01:51.280 --> 01:56.080
So we'll put that into 23.1.2.100. Next, let's specify the transport protocols.

44
01:56.080 --> 01:56.480
We'll go ahead

45
01:56.480 --> 02:00.820
and put transport there space and let's use UDP because this is the servers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:56.480 --> 02:00.820
and put transport there space and let's use UDP because this is the servers

46
02:00.820 --> 02:02.480
configured to receive

47
02:02.480 --> 02:07.840
on. And for the port, it's going to be 9996. And that would again depend on

48
02:07.840 --> 02:09.040
what port your

49
02:09.040 --> 02:12.860
NetFlow collector is set up to listen on. So press enter. And then finally, let

50
02:12.860 --> 02:13.920
's also go ahead

51
02:13.920 --> 02:18.220
and source our traffic from our loopback interface here on R2. So we'll say

52
02:18.220 --> 02:20.000
source space question mark.

53
02:20.000 --> 02:23.920
Then we'll specify loopback zero as the interface we have sourcing from.

54
02:23.920 --> 02:28.360
Let's also do a do show IP interface brief, just to verify that we do have loop

55
02:28.360 --> 02:29.040
back zero.

56
02:29.040 --> 02:34.700
And it is at 222 fantastic. So now if you do a show flow exporter and press
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:29.040 --> 02:34.700
And it is at 222 fantastic. So now if you do a show flow exporter and press

57
02:34.700 --> 02:35.280
center,

58
02:35.280 --> 02:40.080
here is our flow exporter, it's user defined. That's because we just created it

59
02:40.080 --> 02:40.720
. It's going to be

60
02:40.720 --> 02:45.480
using NetFlow version nine. Here's the destination IP address of our server.

61
02:45.480 --> 02:46.480
Here's our source address

62
02:46.480 --> 02:50.540
we're going to use, which is based on loopback zero. We're going to be using

63
02:50.540 --> 02:51.600
UDP port 9996.

64
02:51.600 --> 02:55.760
So if we do a show flow record, that's identifying what we're matching on to

65
02:55.760 --> 02:57.440
identify flows of traffic.

66
02:57.440 --> 03:01.120
And then we're also additionally collecting this information about those flows.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:57.440 --> 03:01.120
And then we're also additionally collecting this information about those flows.

67
03:01.120 --> 03:02.240
If we do a show

68
03:02.240 --> 03:06.870
flow exporter and press enter, here's who were saying that information to. And

69
03:06.870 --> 03:08.000
so the next step

70
03:08.000 --> 03:12.550
to put this all together is we need to create a flow monitor. And in that flow

71
03:12.550 --> 03:12.960
monitor, we're

72
03:12.960 --> 03:17.090
going to apply it to one or more of our interfaces here on our two. So as part

73
03:17.090 --> 03:18.240
of the flow monitor,

74
03:18.240 --> 03:21.920
it's going to identify which record we're going to go ahead and use to identify

75
03:21.920 --> 03:22.720
flows of traffic

76
03:22.720 --> 03:26.300
and which information to collect. And as part of that flow monitor that we're

77
03:26.300 --> 03:27.280
going to apply to an

78
03:27.280 --> 03:30.930
interface, it's also going to include the information on which flow exporter we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:27.280 --> 03:30.930
interface, it's also going to include the information on which flow exporter we

79
03:30.930 --> 03:32.000
're going to use.

80
03:32.000 --> 03:36.050
So the next video, we're going to use the flow record that we created, which is

81
03:36.050 --> 03:36.560
this one right

82
03:36.560 --> 03:40.280
here to identify what constitutes a flow. And we're also going to include in

83
03:40.280 --> 03:41.520
our monitor this flow

84
03:41.520 --> 03:45.040
exporter called our flow exporter. So I'll see you in the next video as we

85
03:45.040 --> 03:47.360
configure our flow monitor.