WEBVTT

1
00:00.000 --> 00:01.080 align:middle line:84%


2
00:01.080 --> 00:03.032 align:middle line:90%
Choices can be a
double-edged sword.

3
00:03.032 --> 00:04.740 align:middle line:90%
On the positive side,
if we have choices,

4
00:04.740 --> 00:06.250 align:middle line:90%
like, yeah, lots
of great options--

5
00:06.250 --> 00:09.080 align:middle line:90%
and on the negative side,
like, oh, too many options.

6
00:09.080 --> 00:11.070 align:middle line:90%
So in NetFlow we do
have a few options

7
00:11.070 --> 00:13.455 align:middle line:90%
in implementing and using
NetFlow, including versions.

8
00:13.455 --> 00:16.288 align:middle line:90%
And that's what we're going
to discuss in this video.

9
00:16.288 --> 00:18.330 align:middle line:90%
So let's start at the
beginning in the beginning.

10
00:18.330 --> 00:20.260 align:middle line:90%
In the beginning, NetFlow
was created by Cisco.

11
00:20.260 --> 00:21.660 align:middle line:90%
And they came out
with version 1.

12
00:21.660 --> 00:24.000 align:middle line:84%
But it was short-lived.

13
00:24.000 --> 00:26.250 align:middle line:90%
It didn't collect a lot
of useful information.

14
00:26.250 --> 00:28.050 align:middle line:90%
And so basically we
don't use it anymore.

15
00:28.050 --> 00:29.550 align:middle line:90%
And they had a few
other iterations.

16
00:29.550 --> 00:31.740 align:middle line:90%
So the two major ones,
let's focus on those.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.550 --> 00:31.740 align:middle line:90%
So the two major ones,
let's focus on those.

17
00:31.740 --> 00:35.972 align:middle line:90%
The two major ones are
version 5 and version 9.

18
00:35.972 --> 00:37.680 align:middle line:90%
Now, let's talk about
those for a moment.

19
00:37.680 --> 00:40.050 align:middle line:90%
With version 5 and
the earlier versions,

20
00:40.050 --> 00:41.550 align:middle line:90%
basically NetFlow
was pretty simple.

21
00:41.550 --> 00:44.160 align:middle line:90%
It went something like
this, "Dear Mr. Router 1,"--

22
00:44.160 --> 00:45.560 align:middle line:84%
we'll use our NetFlow voice.

23
00:45.560 --> 00:47.730 align:middle line:90%
"Dear Mr. Router 1,
please pay attention

24
00:47.730 --> 00:50.257 align:middle line:90%
to flows that are going
out that interface.

25
00:50.257 --> 00:51.840 align:middle line:90%
And please pay
attention to flows that

26
00:51.840 --> 00:52.700 align:middle line:84%
are going out that interface."

27
00:52.700 --> 00:54.450 align:middle line:90%
So you could do it
out here and out here,

28
00:54.450 --> 00:57.390 align:middle line:90%
or you could do it
in and out here,

29
00:57.390 --> 00:59.930 align:middle line:90%
anywhere you want to collect
the flow information is great.

30
00:59.930 --> 01:00.980 align:middle line:84%
And so we tell it that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
00:59.930 --> 01:00.980 align:middle line:84%
And so we tell it that.

31
01:00.980 --> 01:04.800 align:middle line:90%
And we'd also specify where
the collector was, meaning

32
01:04.800 --> 01:07.380 align:middle line:84%
this is the server at 8888.

33
01:07.380 --> 01:09.370 align:middle line:84%
He's a collector.

34
01:09.370 --> 01:13.262 align:middle line:84%
He's listening on port UDP 6783.

35
01:13.262 --> 01:14.970 align:middle line:90%
And we would've defined
it on the router.

36
01:14.970 --> 01:17.550 align:middle line:90%
And he would cache his
flow or information.

37
01:17.550 --> 01:18.618 align:middle line:84%
And then ship it out.

38
01:18.618 --> 01:20.160 align:middle line:90%
Very limited, though,
with version 5,

39
01:20.160 --> 01:21.960 align:middle line:84%
as far as what we could collect.

40
01:21.960 --> 01:23.447 align:middle line:90%
But there were
like some defaults

41
01:23.447 --> 01:25.530 align:middle line:90%
of what it would look at
and flow information that

42
01:25.530 --> 01:26.822 align:middle line:84%
was sent over to the collector.

43
01:26.822 --> 01:28.500 align:middle line:84%
Then we'd use our analy--

44
01:28.500 --> 01:33.120 align:middle line:90%
A-N-A-L-Y-Z-E. We'd use our
analyzing tool to look at that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:28.500 --> 01:33.120 align:middle line:90%
A-N-A-L-Y-Z-E. We'd use our
analyzing tool to look at that

45
01:33.120 --> 01:35.640 align:middle line:90%
data and make graphs
and charts and reports.

46
01:35.640 --> 01:37.020 align:middle line:84%
That's version 5, pretty much.

47
01:37.020 --> 01:39.600 align:middle line:90%
Now, what happened
was that there

48
01:39.600 --> 01:42.960 align:middle line:90%
are a lot of additional details
that we could have looked

49
01:42.960 --> 01:46.500 align:middle line:90%
at with NetFlow,
including things like IPv6

50
01:46.500 --> 01:50.040 align:middle line:90%
and details and the IP headers
and packets and payloads

51
01:50.040 --> 01:51.240 align:middle line:84%
that we might want included.

52
01:51.240 --> 01:53.930 align:middle line:90%
Or maybe we don't want
some of that information.

53
01:53.930 --> 01:58.050 align:middle line:90%
So with version 9, they
made it very flexible.

54
01:58.050 --> 02:01.320 align:middle line:90%
And so sometimes if you
see Flexible NetFlow,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:58.050 --> 02:01.320 align:middle line:90%
And so sometimes if you
see Flexible NetFlow,

55
02:01.320 --> 02:04.260 align:middle line:90%
they're referring to version
9 or its cousin version

56
02:04.260 --> 02:06.300 align:middle line:84%
10, which is modular.

57
02:06.300 --> 02:09.630 align:middle line:90%
And you might say, Keith,
what is modular about NetFlow?

58
02:09.630 --> 02:12.420 align:middle line:90%
Well, with version 9 if
we're using Flexible NetFlow,

59
02:12.420 --> 02:15.680 align:middle line:90%
we can create an
object called a record.

60
02:15.680 --> 02:19.590 align:middle line:90%
Now, a record, think of
it, like, you know how,

61
02:19.590 --> 02:21.450 align:middle line:90%
like, in NAT, you
have an Access Control

62
02:21.450 --> 02:23.482 align:middle line:90%
List that says what
you want to look at

63
02:23.482 --> 02:25.440 align:middle line:90%
or what you want to permit
through the network,

64
02:25.440 --> 02:27.840 align:middle line:90%
or with QoS use an
access list of, say, what

65
02:27.840 --> 02:29.630 align:middle line:84%
traffic we want to manipulate?

66
02:29.630 --> 02:31.890 align:middle line:90%
Well, record, think of it
like pointing out which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.630 --> 02:31.890 align:middle line:90%
Well, record, think of it
like pointing out which

67
02:31.890 --> 02:34.320 align:middle line:90%
parts of the traffic
that's flowing through

68
02:34.320 --> 02:35.610 align:middle line:84%
that you want to look at.

69
02:35.610 --> 02:37.800 align:middle line:90%
Maybe you want to
look at IPv4 traffic,

70
02:37.800 --> 02:41.310 align:middle line:90%
but just source addresses,
or IPv6 traffic, but just

71
02:41.310 --> 02:43.050 align:middle line:90%
destination address,
or whatever it is.

72
02:43.050 --> 02:44.425 align:middle line:90%
You can create
these records that

73
02:44.425 --> 02:48.090 align:middle line:90%
identify what we want
to go ahead and look at.

74
02:48.090 --> 02:49.560 align:middle line:90%
So we'd create
these record objects

75
02:49.560 --> 02:51.188 align:middle line:84%
and that's why it's modular.

76
02:51.188 --> 02:53.230 align:middle line:90%
It's like a template of
what we want to look for.

77
02:53.230 --> 02:54.385 align:middle line:84%
And then we could--

78
02:54.385 --> 02:56.760 align:middle line:90%
I'll walk you through the
process here in just a moment--

79
02:56.760 --> 02:58.470 align:middle line:90%
but we could then
apply that as part

80
02:58.470 --> 03:01.380 align:middle line:90%
of our monitoring process,
which leads me to my next piece.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.470 --> 03:01.380 align:middle line:90%
of our monitoring process,
which leads me to my next piece.

81
03:01.380 --> 03:05.180 align:middle line:90%
We create another object called
a monitor, M-O-N-I-T-O-R,

82
03:05.180 --> 03:05.680 align:middle line:84%
monitor?

83
03:05.680 --> 03:06.900 align:middle line:84%
Yeah, that sounds right.

84
03:06.900 --> 03:09.420 align:middle line:90%
So what a monitor
does is a monitor

85
03:09.420 --> 03:13.272 align:middle line:90%
is an object that specifies what
record we're going to be using,

86
03:13.272 --> 03:14.730 align:middle line:90%
meaning what do we
want to look at.

87
03:14.730 --> 03:17.520 align:middle line:90%
And we would apply the
monitor to an interface.

88
03:17.520 --> 03:21.090 align:middle line:90%
We could apply a monitor
inbound or outbound on gig 1/0,

89
03:21.090 --> 03:23.280 align:middle line:90%
and then based on that
monitor that's applied,

90
03:23.280 --> 03:25.920 align:middle line:90%
it would know what record
to go ahead and apply,

91
03:25.920 --> 03:28.260 align:middle line:90%
meaning the router
would know, here

92
03:28.260 --> 03:30.120 align:middle line:90%
is the layer 4
information I need
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:28.260 --> 03:30.120 align:middle line:90%
is the layer 4
information I need

93
03:30.120 --> 03:32.370 align:middle line:90%
to collect or pay attention
to as part of these flows.

94
03:32.370 --> 03:35.760 align:middle line:90%
Or if it's IPv4, IPv6, and so
forth, based on the records.

95
03:35.760 --> 03:39.630 align:middle line:90%
The other part that's
modular is the exporter.

96
03:39.630 --> 03:42.330 align:middle line:90%
And so the concept of
exporting in NetFlow

97
03:42.330 --> 03:45.660 align:middle line:90%
is where this router takes
its cached information

98
03:45.660 --> 03:48.150 align:middle line:90%
about these flows and ships
it off to the collector.

99
03:48.150 --> 03:49.710 align:middle line:90%
But instead of
just defining here

100
03:49.710 --> 03:52.530 align:middle line:90%
is my destination
for exporting, we

101
03:52.530 --> 03:54.330 align:middle line:84%
can create an exporter object.

102
03:54.330 --> 03:56.220 align:middle line:90%
And in that exporter
object, we can

103
03:56.220 --> 03:58.980 align:middle line:90%
specify the IP address of
the destination server,

104
03:58.980 --> 04:01.380 align:middle line:90%
the ports involved,
our source interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
03:58.980 --> 04:01.380 align:middle line:90%
the ports involved,
our source interface.

105
04:01.380 --> 04:03.990 align:middle line:90%
And also, when we
apply the monitor,

106
04:03.990 --> 04:05.260 align:middle line:84%
we can include the records.

107
04:05.260 --> 04:09.960 align:middle line:90%
So if we apply this monitor
to gig 1/0 outbound,

108
04:09.960 --> 04:12.180 align:middle line:90%
that monitor could say
we want to pay attention

109
04:12.180 --> 04:14.730 align:middle line:90%
to these records and
that information.

110
04:14.730 --> 04:17.279 align:middle line:90%
And also, when you
get that cached,

111
04:17.279 --> 04:19.980 align:middle line:90%
we also want you to export it
to this destination IP address

112
04:19.980 --> 04:21.450 align:middle line:84%
defined in the exporter.

113
04:21.450 --> 04:24.660 align:middle line:90%
So Flexible NetFlow,
it's very modular.

114
04:24.660 --> 04:27.450 align:middle line:90%
So you can create
additional records, objects,

115
04:27.450 --> 04:29.550 align:middle line:90%
and monitor objects
and exporter objects,

116
04:29.550 --> 04:31.350 align:middle line:84%
link them together, apply them.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:29.550 --> 04:31.350 align:middle line:84%
link them together, apply them.

117
04:31.350 --> 04:33.720 align:middle line:90%
The key is the monitor gets
applied to the interface

118
04:33.720 --> 04:36.190 align:middle line:90%
and the monitor is going to
point to what the record is,

119
04:36.190 --> 04:38.730 align:middle line:90%
and also what the exporter is
so it knows what to collect

120
04:38.730 --> 04:39.780 align:middle line:84%
and where to send it.

121
04:39.780 --> 04:43.420 align:middle line:90%
Ba-da-bing, Flexible
NetFlow, version 9.

122
04:43.420 --> 04:46.020 align:middle line:84%
Now, there is one other option.

123
04:46.020 --> 04:49.320 align:middle line:90%
And that is that Cisco,
when they created NetFlow,

124
04:49.320 --> 04:50.970 align:middle line:90%
there have been some
standardizations

125
04:50.970 --> 04:54.330 align:middle line:90%
and some RFC's that help
standardize the exporting.

126
04:54.330 --> 04:59.190 align:middle line:90%
And so there's a thing called
IP F-I-X. That's the acronym.

127
04:59.190 --> 05:02.962 align:middle line:90%
And it stands for IP
Flow Information Export.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
04:59.190 --> 05:02.962 align:middle line:90%
And it stands for IP
Flow Information Export.

128
05:02.962 --> 05:04.920 align:middle line:90%
I know export starts with
an E, but they wanted

129
05:04.920 --> 05:05.962 align:middle line:84%
to make the acronym work.

130
05:05.962 --> 05:09.180 align:middle line:90%
So IPFIX is the
standards-based method

131
05:09.180 --> 05:13.440 align:middle line:90%
for exporting that flow record
information out to a collector.

132
05:13.440 --> 05:16.060 align:middle line:90%
And so in a Cisco
environment, when

133
05:16.060 --> 05:17.850 align:middle line:90%
we're defining the
exporter, we can

134
05:17.850 --> 05:20.400 align:middle line:90%
say we want do exporting
using version 9,

135
05:20.400 --> 05:22.950 align:middle line:90%
or we could use
exporter protocol

136
05:22.950 --> 05:27.270 align:middle line:90%
IPFIX, which they put in
parentheses, sometimes, a 10.

137
05:27.270 --> 05:30.660 align:middle line:90%
And with version 10 with IPFIX,
it's referring to the protocol
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
05:27.270 --> 05:30.660 align:middle line:90%
And with version 10 with IPFIX,
it's referring to the protocol

138
05:30.660 --> 05:33.600 align:middle line:90%
that we could use between the
router and the device that's

139
05:33.600 --> 05:37.877 align:middle line:90%
receiving all those flows from
the router who's caching them.

140
05:37.877 --> 05:39.960 align:middle line:90%
So now that we know some
of the flavors of NetFlow

141
05:39.960 --> 05:42.502 align:middle line:90%
that we're likely to see in a
production environment and use,

142
05:42.502 --> 05:44.130 align:middle line:90%
in the next video,
I'd like to walk you

143
05:44.130 --> 05:47.760 align:middle line:90%
through a hands-on lab of both
implementing and verifying

144
05:47.760 --> 05:49.135 align:middle line:84%
NetFlow version 5.

145
05:49.135 --> 05:50.760 align:middle line:90%
So I'll see you there
in just a moment.

146
05:50.760 --> 05:53.250 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

147
05:53.250 --> 05:56.350 align:middle line:90%
And I'd like to thank
you for viewing.