WEBVTT

1
00:00.000 --> 00:02.700
So how did you do? How did you do with the lab?

2
00:02.700 --> 00:04.000
Hopefully you did. Great.

3
00:04.000 --> 00:07.000
The more you practice working with any technology,

4
00:07.000 --> 00:09.300
the better and more comfortable you're going to be with it.

5
00:09.300 --> 00:11.500
And that equates to actually in production

6
00:11.500 --> 00:14.600
being more efficient and effective in configuring and off

7
00:14.600 --> 00:17.200
and troubleshooting when something doesn't go quite right.

8
00:17.200 --> 00:19.400
So with these tasks in mind,

9
00:19.400 --> 00:21.500
join me in the walkthrough right now

10
00:21.500 --> 00:23.200
as we implement these lab tasks

11
00:23.200 --> 00:26.300
and verify flexible net flow on R2.

12
00:26.300 --> 00:29.700
So I've taken the liberty of using the reset option here on the lab

13
00:29.700 --> 00:30.700
and I've restarted it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.700 --> 00:30.700
and I've restarted it.

14
00:30.700 --> 00:32.700
So it's going to be back at square one.

15
00:32.700 --> 00:34.900
And as a reminder, if you're in the middle of a lab

16
00:34.900 --> 00:36.200
and you something goes wrong

17
00:36.200 --> 00:38.400
or you just want to start over from scratch,

18
00:38.400 --> 00:40.500
please feel free to use that reset option

19
00:40.500 --> 00:41.700
and then restart the lab

20
00:41.700 --> 00:44.000
and it'll give you a nice fresh start anytime you need it.

21
00:44.000 --> 00:45.000
And here we go.

22
00:45.000 --> 00:46.700
So I'm going to go ahead and first of all double click

23
00:46.700 --> 00:49.800
on the lab topology icon here on the desktop

24
00:49.800 --> 00:50.800
just so we have it available.

25
00:50.800 --> 00:53.100
Also, this topology is in the skills.

26
00:53.100 --> 00:55.100
So if you want to download it from the skill

27
00:55.100 --> 00:56.300
or put it on a second monitor,

28
00:56.300 --> 00:58.600
so it's really easy to look at that be good too.

29
00:58.600 --> 01:01.400
So next, let's go ahead and double click on server one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:58.600 --> 01:01.400
So next, let's go ahead and double click on server one

30
01:01.400 --> 01:04.300
and open that up so we can get to the console access for R2.

31
01:04.300 --> 01:05.900
And here comes server one.

32
01:05.900 --> 01:09.100
We'll give that a moment to initialize fantastic.

33
01:09.100 --> 01:10.600
And then we're also going to need client nugge

34
01:10.600 --> 01:11.500
to generate some traffic.

35
01:11.500 --> 01:15.400
So I'm going to go ahead and double click on client nugge as well.

36
01:15.400 --> 01:17.900
Then I can toggle between them down here from the taskbar.

37
01:17.900 --> 01:20.900
So this is client nugge and let's go and minimize that

38
01:20.900 --> 01:22.400
and let's go back to server one.

39
01:22.400 --> 01:25.800
And here we have the tab for R2 fantastic.

40
01:25.800 --> 01:29.200
So let me do a quick show flow record.

41
01:29.200 --> 01:30.800
Make sure I don't have any customized records yet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.200 --> 01:30.800
Make sure I don't have any customized records yet.

42
01:30.800 --> 01:36.800
Show flow exporter and show flow monitor and nothing fantastic.

43
01:36.800 --> 01:39.800
So let's start off by creating our flow record.

44
01:39.800 --> 01:43.100
So I also have here on this computer on server one.

45
01:43.100 --> 01:45.800
I've got a little notepad document and it's called net floats

46
01:45.800 --> 01:46.600
right on the desktop.

47
01:46.600 --> 01:48.600
If you close this and you need to refine it,

48
01:48.600 --> 01:51.200
it's on the desktop and this basically has the syntax.

49
01:51.200 --> 01:53.300
So if you want to peek at this or refer to this,

50
01:53.300 --> 01:54.400
please feel free to do that.

51
01:54.400 --> 01:57.700
If I go ahead and make this a little bit smaller and scootch this

52
01:57.700 --> 02:00.800
over just a little bit and move that over a little bit to the right
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:57.700 --> 02:00.800
over just a little bit and move that over a little bit to the right

53
02:00.800 --> 02:02.400
so we can see both of them at the same time.

54
02:02.400 --> 02:05.000
So in configuration mode, we'll create our flow record first

55
02:05.000 --> 02:07.200
and effectively it's going to be these commands right here.

56
02:07.200 --> 02:09.200
We do the same ones in the demo earlier.

57
02:09.200 --> 02:11.200
So I'm going to copy those from our text document,

58
02:11.200 --> 02:15.000
put it in then we can do a do show flow record.

59
02:15.000 --> 02:18.300
And there's our flow record matching on IPV for source

60
02:18.300 --> 02:20.600
and destination address and also the IPV for protocol.

61
02:20.600 --> 02:22.700
And then if we want to, we can also go ahead and add a collect.

62
02:22.700 --> 02:25.000
So if you're typing collect and space question mark,

63
02:25.000 --> 02:28.100
we could go ahead and also add other items as well

64
02:28.100 --> 02:29.300
as far as the information you want to collect.

65
02:29.300 --> 02:32.900
But for the lab, I just want to match on those three things
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.300 --> 02:32.900
But for the lab, I just want to match on those three things

66
02:32.900 --> 02:34.400
to identify a flow.

67
02:34.400 --> 02:35.500
So that's in place.

68
02:35.500 --> 02:37.500
So our next step is to create our export.

69
02:37.500 --> 02:40.500
And the reason I'm doing the record first and then the exporter

70
02:40.500 --> 02:43.500
and then the monitors because the monitor right here includes

71
02:43.500 --> 02:46.800
pointing to which record we want to use and which exporter we want to use.

72
02:46.800 --> 02:49.800
So if you don't have them created first, you can't actually include them.

73
02:49.800 --> 02:54.900
So for our flow exporter, we're going to call it our dash flow dash exporter.

74
02:54.900 --> 02:57.800
The destinations are server at 23 dot 1 dot 2 dot 100.

75
02:57.800 --> 03:01.000
Our source is going to be loop back zero and the transport is going to be UDP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:57.800 --> 03:01.000
Our source is going to be loop back zero and the transport is going to be UDP

76
03:01.000 --> 03:02.500
port 996.

77
03:02.500 --> 03:03.600
So I'm going to copy that.

78
03:03.600 --> 03:07.400
I'm going to exit out of the flow record configuration back to global config

79
03:07.400 --> 03:09.500
and paste that in and boom.

80
03:09.500 --> 03:13.300
Now if we do a do show flow exporter and press center,

81
03:13.300 --> 03:15.800
there's our flow exporter with the destination address,

82
03:15.800 --> 03:19.000
the port, the source address and that looks good to go.

83
03:19.000 --> 03:22.800
So next we'll exit out of exporter configuration mode and we'll create our flow

84
03:22.800 --> 03:23.200
monitor

85
03:23.200 --> 03:27.110
and the flow monitor is simply going to include the record that we created

86
03:27.110 --> 03:27.400
earlier

87
03:27.400 --> 03:30.200
as far as what we want to use and which exporter we want to use.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:27.400 --> 03:30.200
as far as what we want to use and which exporter we want to use.

88
03:30.200 --> 03:33.100
So we'll go ahead and copy that, paste that in.

89
03:33.100 --> 03:36.400
And now that that's done, we can do a do show flow monitor.

90
03:36.400 --> 03:39.300
And then once that's done, we do a do show flow monitor just to confirm.

91
03:39.300 --> 03:44.500
So we do a show flow record show flow exporter show flow monitor just to verify

92
03:44.500 --> 03:47.700
each of the pieces, which is not a bad idea to do right now.

93
03:47.700 --> 03:50.200
Before we apply this flow monitor to an interface,

94
03:50.200 --> 03:56.700
let's do a show flow record that looks good and a show flow exporter.

95
03:56.700 --> 04:01.200
And that looks good and a show flow monitor and that looks good.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:56.700 --> 04:01.200
And that looks good and a show flow monitor and that looks good.

96
04:01.200 --> 04:01.700
Great.

97
04:01.700 --> 04:05.900
So next let's apply this to the three interfaces on our two.

98
04:05.900 --> 04:10.700
So we're going to configuration mode interface range for gig zero slash zero

99
04:10.700 --> 04:14.700
and gig one slash zero and gig two slash zero.

100
04:14.700 --> 04:17.400
And then we'll apply that and let's take a look at the lab task real quick.

101
04:17.400 --> 04:20.800
They wanted to apply that inbound on those three interfaces.

102
04:20.800 --> 04:21.800
So we'll do that next.

103
04:21.800 --> 04:26.500
So the syntax would be IP, hello monitor, a question mark, the name of our

104
04:26.500 --> 04:27.000
monitor.

105
04:27.000 --> 04:32.000
So I'll go ahead and also copy paste that so type of space question mark.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
04:27.000 --> 04:32.000
So I'll go ahead and also copy paste that so type of space question mark.

106
04:32.000 --> 04:33.800
And we want it for ingress traffic.

107
04:33.800 --> 04:37.600
So we'll say input and press center boom and we are done.

108
04:37.600 --> 04:43.200
So now if we did a show flow monitor based question mark and we put the name

109
04:43.200 --> 04:46.700
of our flow monitor and space question mark and then typing cache,

110
04:46.700 --> 04:48.000
it'll show us the current cache.

111
04:48.000 --> 04:52.600
And so currently we have based on protocol UDP that's protocol number 17.

112
04:52.600 --> 04:55.000
That's UDP traffic going from our client to the server.

113
04:55.000 --> 04:58.910
Looks like we have some ICMP traffic, which is protocol one going from the

114
04:58.910 --> 04:59.200
server

115
04:59.200 --> 05:00.200
to that client.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:59.200 --> 05:00.200
to that client.

116
05:00.200 --> 05:03.600
And then we have protocol 89, which is OSPF.

117
05:03.600 --> 05:06.740
And because in the record we're using, we didn't ask for information about the

118
05:06.740 --> 05:07.300
TOS

119
05:07.300 --> 05:12.200
or the precedence or the TTL that information isn't included because it wasn't

120
05:12.200 --> 05:13.200
being asked for.

121
05:13.200 --> 05:16.000
So let's generate some traffic from our Windows client.

122
05:16.000 --> 05:17.800
So we go down to our Windows client down here.

123
05:17.800 --> 05:20.180
If it's not open, you just go ahead and open it up with client and I go up at

124
05:20.180 --> 05:20.700
the top right.

125
05:20.700 --> 05:24.000
And let's do something that we haven't done previously.

126
05:24.000 --> 05:28.000
And let's go ahead and ping some remote IP address.

127
05:28.000 --> 05:30.200
So in the bottom left, we have our Windows client machine.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:28.000 --> 05:30.200
So in the bottom left, we have our Windows client machine.

128
05:30.200 --> 05:35.800
Let's go ahead and ping about our fours gig one zero interface address,

129
05:35.800 --> 05:38.800
which is 1034 zero dot four.

130
05:38.800 --> 05:44.100
So go ahead and do a ping to 10 dot 34 dot zero dot four press center.

131
05:44.100 --> 05:47.900
That seems to be working and we'll go back down to server one.

132
05:47.900 --> 05:50.200
We'll hit the up arrow key and look at the cache again.

133
05:50.200 --> 05:53.000
And this time we should have that cache.

134
05:53.000 --> 05:54.200
This time we should have that information.

135
05:54.200 --> 05:58.600
So there's protocol one from 10, 10, 0, 50 going to 1034, 0, 4.

136
05:58.600 --> 06:01.100
And there is the reply traffic coming back.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:58.600 --> 06:01.100
And there is the reply traffic coming back.

137
06:01.100 --> 06:04.900
And that's because we have the monitor applied to gig one zero and gig zero

138
06:04.900 --> 06:06.300
zero inbound.

139
06:06.300 --> 06:09.560
And that's why it's catching both sides of that conversation or in the case of

140
06:09.560 --> 06:10.400
net flow,

141
06:10.400 --> 06:11.600
both flows of traffic.

142
06:11.600 --> 06:15.500
So thanks for joining me in this set of videos and his hands on lab regarding

143
06:15.500 --> 06:16.800
flexible net flow.

144
06:16.800 --> 06:20.350
And I look forward to seeing you my friend in a future set of videos very, very

145
06:20.350 --> 06:20.500
soon.

146
06:20.500 --> 06:24.850
Until then, I hope this has been informative and I'd like to thank you for

147
06:24.850 --> 06:25.400
viewing.