WEBVTT

1
00:00.000 --> 00:00.718 align:middle line:84%


2
00:00.718 --> 00:02.760 align:middle line:90%
All right, my friend, it's
time to get some hands

3
00:02.760 --> 00:03.990 align:middle line:84%
on with some NetFlow.

4
00:03.990 --> 00:05.790 align:middle line:90%
So let me introduce
the topology.

5
00:05.790 --> 00:08.310 align:middle line:90%
If you are logged on to
the CBT Nuggets website,

6
00:08.310 --> 00:10.010 align:middle line:90%
click on the link
for the Virtual lab,

7
00:10.010 --> 00:12.990 align:middle line:90%
and let's configure and
verify NetFlow together.

8
00:12.990 --> 00:15.870 align:middle line:90%
And because we're going to
start with NetFlow version 5,

9
00:15.870 --> 00:17.740 align:middle line:84%
it's very simple to configure.

10
00:17.740 --> 00:20.340 align:middle line:90%
We're going to go into
interface configuration mode.

11
00:20.340 --> 00:21.660 align:middle line:84%
And let's do it on R1.

12
00:21.660 --> 00:23.780 align:middle line:90%
And we'll simply tell
it to pay attention

13
00:23.780 --> 00:26.340 align:middle line:90%
to traffic that's going out
that interface and also traffic

14
00:26.340 --> 00:27.960 align:middle line:84%
going in that interface.

15
00:27.960 --> 00:30.100 align:middle line:90%
And then we probably want
to generate some traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:27.960 --> 00:30.100 align:middle line:90%
And then we probably want
to generate some traffic.

16
00:30.100 --> 00:33.090 align:middle line:90%
So to generate traffic,
let's go to R7.

17
00:33.090 --> 00:37.237 align:middle line:90%
And on R7, we can just do
a telnet session to R8.

18
00:37.237 --> 00:38.820 align:middle line:90%
And that'll give us
enough information

19
00:38.820 --> 00:41.590 align:middle line:90%
to go ahead and see
the flow in the cache.

20
00:41.590 --> 00:44.250 align:middle line:90%
We can also define a collector,
although I don't have

21
00:44.250 --> 00:45.730 align:middle line:84%
a collector in the topology.

22
00:45.730 --> 00:47.147 align:middle line:90%
We'll go ahead and
use a collector

23
00:47.147 --> 00:52.210 align:middle line:84%
at address 1.2.3.4, UDP port--

24
00:52.210 --> 00:54.520 align:middle line:84%
let's do 6783.

25
00:54.520 --> 00:56.790 align:middle line:84%
All right, so here we go.

26
00:56.790 --> 00:59.010 align:middle line:90%
Well, I'm just going to do
a show IP interface brief,

27
00:59.010 --> 01:01.050 align:middle line:90%
just to make sure I'm
on the right interfaces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.010 --> 01:01.050 align:middle line:90%
just to make sure I'm
on the right interfaces.

28
01:01.050 --> 01:03.750 align:middle line:90%
And let's go ahead
and play with gig 1/0.

29
01:03.750 --> 01:07.468 align:middle line:90%
And we'll do outbound and
inbound, telling it to cache,

30
01:07.468 --> 01:09.510 align:middle line:90%
or gather in, the flow
information we're getting,

31
01:09.510 --> 01:11.860 align:middle line:90%
traffic going out or
in on that interface.

32
01:11.860 --> 01:13.860 align:middle line:90%
So to do that, we'll go
into configuration mode.

33
01:13.860 --> 01:16.660 align:middle line:90%
And interface gig, make
sure I get the right one--

34
01:16.660 --> 01:17.760 align:middle line:84%
1/0.

35
01:17.760 --> 01:18.720 align:middle line:84%
Fantastic.

36
01:18.720 --> 01:20.880 align:middle line:84%
IP flow is the syntax.

37
01:20.880 --> 01:23.750 align:middle line:90%
And we'll just say ingress
for traffic coming in

38
01:23.750 --> 01:24.500 align:middle line:84%
on that interface.

39
01:24.500 --> 01:27.200 align:middle line:90%
And we'll also do
egress as well.

40
01:27.200 --> 01:28.815 align:middle line:84%
So next, let's specify where--

41
01:28.815 --> 01:31.190 align:middle line:90%
when we get this information,
we collect this information
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:28.815 --> 01:31.190 align:middle line:90%
when we get this information,
we collect this information

42
01:31.190 --> 01:33.130 align:middle line:90%
that flows-- where
it should send it.

43
01:33.130 --> 01:34.960 align:middle line:90%
So we'll exit out of
configuration mode.

44
01:34.960 --> 01:37.810 align:middle line:90%
We'll do IP flow
and a question mark.

45
01:37.810 --> 01:40.210 align:middle line:84%
And we want flow-export.

46
01:40.210 --> 01:42.760 align:middle line:90%
And so IP flow-export,
destination

47
01:42.760 --> 01:43.970 align:middle line:84%
is going to be that.

48
01:43.970 --> 01:47.500 align:middle line:90%
1.2.3.4, which is the IP
address of the server who's

49
01:47.500 --> 01:49.450 align:middle line:84%
going to be listening for us.

50
01:49.450 --> 01:51.880 align:middle line:84%
And-- it says you weren't done.

51
01:51.880 --> 01:53.140 align:middle line:84%
And the UDP port number.

52
01:53.140 --> 01:56.240 align:middle line:84%
We'll use 6783.

53
01:56.240 --> 01:59.340 align:middle line:90%
And we can also specify
an IP flow-export.

54
01:59.340 --> 02:00.960 align:middle line:84%
We can also specify the source.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:59.340 --> 02:00.960 align:middle line:84%
We can also specify the source.

55
02:00.960 --> 02:03.570 align:middle line:90%
If we want to source
this from our loopback 0,

56
02:03.570 --> 02:05.270 align:middle line:84%
we can do that as well.

57
02:05.270 --> 02:07.920 align:middle line:90%
So we'll do loopback 0
as our source address.

58
02:07.920 --> 02:10.350 align:middle line:90%
Not required, but
certainly an option.

59
02:10.350 --> 02:13.560 align:middle line:90%
And we should also specify
what version for the export.

60
02:13.560 --> 02:15.790 align:middle line:90%
And here we have
options for 1, 5, and 9.

61
02:15.790 --> 02:16.980 align:middle line:90%
And we're going to say
5 here because that's

62
02:16.980 --> 02:18.272 align:middle line:84%
the version we're going to use.

63
02:18.272 --> 02:20.868 align:middle line:90%
But even if we said 9, that's
just for the export function.

64
02:20.868 --> 02:22.410 align:middle line:90%
That doesn't make
it Flexible NetFlow

65
02:22.410 --> 02:27.180 align:middle line:90%
because we're not creating
the monitor, or the exporter,

66
02:27.180 --> 02:30.930 align:middle line:90%
or the record objects, as we
will with Flexible NetFlow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:27.180 --> 02:30.930 align:middle line:90%
or the record objects, as we
will with Flexible NetFlow.

67
02:30.930 --> 02:33.120 align:middle line:90%
So here, we're going
to use version 5.

68
02:33.120 --> 02:34.360 align:middle line:84%
And we are done.

69
02:34.360 --> 02:36.990 align:middle line:90%
Let's take a look at
some show commands.

70
02:36.990 --> 02:44.050 align:middle line:90%
Let's do a show IP cache
flow and press Enter.

71
02:44.050 --> 02:46.300 align:middle line:90%
And it's saying that there's
not a whole bunch of data

72
02:46.300 --> 02:47.192 align:middle line:84%
here yet cached.

73
02:47.192 --> 02:49.150 align:middle line:90%
And that's because we
don't have traffic that's

74
02:49.150 --> 02:51.010 align:middle line:84%
flowing through our router yet.

75
02:51.010 --> 02:54.100 align:middle line:90%
So this is showing us a
packet-sized distribution.

76
02:54.100 --> 02:56.405 align:middle line:90%
And down here,
there's just nothing

77
02:56.405 --> 02:57.530 align:middle line:84%
in the cache at the moment.

78
02:57.530 --> 03:00.005 align:middle line:90%
So let's put something
in the cache that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:57.530 --> 03:00.005 align:middle line:90%
So let's put something
in the cache that

79
03:00.005 --> 03:01.130 align:middle line:84%
has something to work with.

80
03:01.130 --> 03:03.730 align:middle line:84%
And to do that, let's go to R7.

81
03:03.730 --> 03:06.250 align:middle line:84%
And let's telnet over to R8.

82
03:06.250 --> 03:10.230 align:middle line:84%
R8 is at 10.2--

83
03:10.230 --> 03:11.230 align:middle line:84%
look at this IP address.

84
03:11.230 --> 03:12.058 align:middle line:84%
This will do.

85
03:12.058 --> 03:14.350 align:middle line:90%
We'll look at this IP address,
then we'll telnet to it.

86
03:14.350 --> 03:18.790 align:middle line:90%
Let's go to R8 and do a
show IP interface brief.

87
03:18.790 --> 03:22.660 align:middle line:90%
And I know that the one
that's reachable is 10.2.68.8.

88
03:22.660 --> 03:27.480 align:middle line:90%
I'm just going to copy that and
go back to R7 and do a ping.

89
03:27.480 --> 03:29.650 align:middle line:84%
Just go ahead and telnet there.

90
03:29.650 --> 03:31.850 align:middle line:84%
And we'll put the address in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:29.650 --> 03:31.850 align:middle line:84%
And we'll put the address in.

91
03:31.850 --> 03:32.350 align:middle line:84%
Great.

92
03:32.350 --> 03:33.558 align:middle line:84%
So now we're connected to R8.

93
03:33.558 --> 03:34.900 align:middle line:84%
So if we generate some traffic--

94
03:34.900 --> 03:37.500 align:middle line:84%
show run.

95
03:37.500 --> 03:38.918 align:middle line:84%
Hit spacebar a few times.

96
03:38.918 --> 03:40.210 align:middle line:84%
That's generating some traffic.

97
03:40.210 --> 03:42.680 align:middle line:90%
That's definitely-- that
flow information is recorded.

98
03:42.680 --> 03:44.680 align:middle line:84%
And let's go back to R1.

99
03:44.680 --> 03:46.240 align:middle line:84%
And we'll hit the up arrow key.

100
03:46.240 --> 03:48.580 align:middle line:84%
Show IP cash flow.

101
03:48.580 --> 03:50.610 align:middle line:90%
And it should show
us that information.

102
03:50.610 --> 03:52.680 align:middle line:90%
So it has some packet
distribution information

103
03:52.680 --> 03:54.090 align:middle line:84%
up above.

104
03:54.090 --> 03:56.220 align:middle line:90%
It's also showing us right
here on these interfaces

105
03:56.220 --> 03:58.050 align:middle line:90%
about source address
and destination

106
03:58.050 --> 04:01.590 align:middle line:90%
address, protocol numbers,
and also packets involved.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:58.050 --> 04:01.590 align:middle line:90%
address, protocol numbers,
and also packets involved.

107
04:01.590 --> 04:02.140 align:middle line:84%
Fantastic.

108
04:02.140 --> 04:04.140 align:middle line:90%
So what this device is
going to do periodically,

109
04:04.140 --> 04:06.720 align:middle line:90%
it's going to ship this
information from its cache

110
04:06.720 --> 04:08.820 align:middle line:90%
and ship it over to
the NetFlow Collector

111
04:08.820 --> 04:10.320 align:middle line:90%
and then forget
about it locally.

112
04:10.320 --> 04:12.618 align:middle line:90%
Now, if we had a
collector sitting there,

113
04:12.618 --> 04:14.160 align:middle line:90%
it would collect
all that information

114
04:14.160 --> 04:15.610 align:middle line:84%
from all the devices.

115
04:15.610 --> 04:17.279 align:middle line:90%
Then we could use
the NetFlow Analyzer

116
04:17.279 --> 04:19.829 align:middle line:90%
to analyze all the data and
make the pretty graphs for us.

117
04:19.829 --> 04:22.350 align:middle line:90%
This is a basic
example of setting up

118
04:22.350 --> 04:25.200 align:middle line:90%
NetFlow version 5
old school before we

119
04:25.200 --> 04:27.502 align:middle line:90%
get into the modular
components, which is coming up.

120
04:27.502 --> 04:29.460 align:middle line:90%
So thanks for joining me
in this video and lab,

121
04:29.460 --> 04:31.080 align:middle line:90%
and I'll see you
in the next video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:29.460 --> 04:31.080 align:middle line:90%
and I'll see you
in the next video.

122
04:31.080 --> 04:33.510 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

123
04:33.510 --> 04:36.740 align:middle line:90%
And I'd like to thank
you for viewing.