WEBVTT

1
00:00.000 --> 00:01.063 align:middle line:84%


2
00:01.063 --> 00:02.480 align:middle line:90%
In this video,
we're going to take

3
00:02.480 --> 00:06.132 align:middle line:90%
a look at Flexible NetFlow with
version 9 and also version 10.

4
00:06.132 --> 00:07.590 align:middle line:90%
And the question
that might come up

5
00:07.590 --> 00:09.300 align:middle line:84%
is, what makes it so flexible?

6
00:09.300 --> 00:09.990 align:middle line:84%
It's modular.

7
00:09.990 --> 00:11.490 align:middle line:90%
We're going to have
separate objects

8
00:11.490 --> 00:13.500 align:middle line:90%
that we can use for
records that identify

9
00:13.500 --> 00:15.380 align:middle line:90%
what we're trying to
identify as traffic

10
00:15.380 --> 00:16.518 align:middle line:84%
goes through the network.

11
00:16.518 --> 00:18.810 align:middle line:90%
We're also going to have
separate objects for monitors,

12
00:18.810 --> 00:20.760 align:middle line:90%
which identify which
records we're tracking

13
00:20.760 --> 00:22.260 align:middle line:84%
and are applied to interfaces.

14
00:22.260 --> 00:24.300 align:middle line:90%
We're also going to have
objects for exporters

15
00:24.300 --> 00:26.588 align:middle line:90%
that identify, where are
we going to send this data?

16
00:26.588 --> 00:27.630 align:middle line:84%
Where are the collectors?

17
00:27.630 --> 00:28.620 align:middle line:84%
What are their IP addresses?

18
00:28.620 --> 00:29.490 align:middle line:84%
What ports are we going to use?

19
00:29.490 --> 00:30.910 align:middle line:90%
What protocol are
we going to use?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:29.490 --> 00:30.910 align:middle line:90%
What protocol are
we going to use?

20
00:30.910 --> 00:31.750 align:middle line:84%
So it's modular.

21
00:31.750 --> 00:34.088 align:middle line:90%
So we can mix and
match any we want to.

22
00:34.088 --> 00:35.880 align:middle line:90%
So for this discussion,
what I'd like to do

23
00:35.880 --> 00:38.220 align:middle line:90%
is take you on some
live gear and walk you

24
00:38.220 --> 00:40.140 align:middle line:90%
through from an interface
perspective that

25
00:40.140 --> 00:41.683 align:middle line:84%
has a monitor applied.

26
00:41.683 --> 00:43.350 align:middle line:90%
And that way we can
reverse engineer it,

27
00:43.350 --> 00:45.610 align:middle line:90%
and show you all the parts
in a production network.

28
00:45.610 --> 00:48.660 align:middle line:90%
So as far as troubleshooting
goes, if something isn't quite

29
00:48.660 --> 00:51.570 align:middle line:90%
going right, if you know
how the pieces fit together,

30
00:51.570 --> 00:53.100 align:middle line:90%
like the monitor,
and the records,

31
00:53.100 --> 00:55.630 align:middle line:90%
and the exporters, and that
way, if it's not working,

32
00:55.630 --> 00:57.325 align:middle line:90%
we can identify
what part's broken

33
00:57.325 --> 00:58.950 align:middle line:90%
and then fix it, and
have functionality

34
00:58.950 --> 01:01.020 align:middle line:84%
again with NetFlow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
00:58.950 --> 01:01.020 align:middle line:84%
again with NetFlow.

35
01:01.020 --> 01:02.190 align:middle line:84%
So here we go.

36
01:02.190 --> 01:03.930 align:middle line:90%
Let's start off
with the interface.

37
01:03.930 --> 01:10.350 align:middle line:90%
Let's do a show run
for interface gig 0/3.

38
01:10.350 --> 01:12.270 align:middle line:90%
So there's a lot of cool
stuff going on here.

39
01:12.270 --> 01:15.600 align:middle line:90%
Let's focus on the parts
that are relevant to NetFlow,

40
01:15.600 --> 01:20.723 align:middle line:90%
including right here it has two
flow monitors that are applied.

41
01:20.723 --> 01:22.890 align:middle line:90%
So let's go ahead and put
one of our objects up here

42
01:22.890 --> 01:25.190 align:middle line:84%
is flow monitor.

43
01:25.190 --> 01:27.690 align:middle line:90%
Now, in these flow monitors,
which we'll take a look at here

44
01:27.690 --> 01:30.330 align:middle line:90%
in just a second, they
are going to identify
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:27.690 --> 01:30.330 align:middle line:90%
in just a second, they
are going to identify

45
01:30.330 --> 01:32.550 align:middle line:90%
the types of records,
the record object,

46
01:32.550 --> 01:34.630 align:middle line:90%
or what we're looking
for as traffic is being

47
01:34.630 --> 01:35.880 align:middle line:84%
routed through this interface.

48
01:35.880 --> 01:39.270 align:middle line:90%
And it's also going to
identify in the flow monitor

49
01:39.270 --> 01:41.795 align:middle line:90%
the exporter, which
has the details on,

50
01:41.795 --> 01:43.920 align:middle line:90%
where do we send these
records once they're cached?

51
01:43.920 --> 01:45.880 align:middle line:84%
And what protocol do we use?

52
01:45.880 --> 01:48.090 align:middle line:90%
So those are all embedded
in the flow monitor.

53
01:48.090 --> 01:50.430 align:middle line:90%
So I think it'd be a
good example if we just

54
01:50.430 --> 01:51.570 align:middle line:84%
took one of these.

55
01:51.570 --> 01:52.320 align:middle line:84%
Let's take SW-MON.

56
01:52.320 --> 01:54.960 align:middle line:84%


57
01:54.960 --> 01:56.130 align:middle line:84%
And this is applied inbound.

58
01:56.130 --> 02:00.300 align:middle line:90%
So any of the records that
are specified by this monitor,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
01:56.130 --> 02:00.300 align:middle line:90%
So any of the records that
are specified by this monitor,

59
02:00.300 --> 02:03.878 align:middle line:90%
and any of the exporters that
are identified by this monitor

60
02:03.878 --> 02:05.670 align:middle line:90%
are going to be used
to be able to identify

61
02:05.670 --> 02:08.693 align:middle line:90%
data to collect, and then where
to send it once it's received.

62
02:08.693 --> 02:10.110 align:middle line:90%
So our next stop
is to take a look

63
02:10.110 --> 02:13.860 align:middle line:90%
at the details of this
monitor object called SW-MON.

64
02:13.860 --> 02:15.570 align:middle line:84%
Let's do that now.

65
02:15.570 --> 02:18.000 align:middle line:84%
So let's do a show run.

66
02:18.000 --> 02:19.080 align:middle line:84%
And let's do a pipe.

67
02:19.080 --> 02:22.380 align:middle line:90%
And let's go ahead and do
a section flow monitor.

68
02:22.380 --> 02:24.780 align:middle line:90%
Now, it's going to show
us all the flow monitors.

69
02:24.780 --> 02:26.670 align:middle line:90%
And we'll just focus
on the one called

70
02:26.670 --> 02:30.960 align:middle line:84%
SW-MON, which is right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:26.670 --> 02:30.960 align:middle line:84%
SW-MON, which is right here.

71
02:30.960 --> 02:33.450 align:middle line:90%
And so in this monitor
object for NetFlow,

72
02:33.450 --> 02:35.252 align:middle line:84%
it's identifying an exporter.

73
02:35.252 --> 02:36.960 align:middle line:90%
So I'm going to make
a note of that here.

74
02:36.960 --> 02:38.460 align:middle line:90%
I'll put a different
color for that.

75
02:38.460 --> 02:40.750 align:middle line:84%
Let's say exporter.

76
02:40.750 --> 02:42.250 align:middle line:90%
And the name of
that flow exporter

77
02:42.250 --> 02:44.650 align:middle line:90%
for this specific monitor
is called SW-EXPORTER.

78
02:44.650 --> 02:48.190 align:middle line:84%


79
02:48.190 --> 02:52.480 align:middle line:90%
This monitor is also identifying
the record object of SW_RECORD

80
02:52.480 --> 02:53.755 align:middle line:84%
right here.

81
02:53.755 --> 02:54.880 align:middle line:84%
So here's the play by play.

82
02:54.880 --> 02:59.500 align:middle line:90%
This flow monitor was applied
to interface gig 0/3 inbound.

83
02:59.500 --> 03:02.410 align:middle line:90%
And that flow monitor
called SW-MON identified
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
02:59.500 --> 03:02.410 align:middle line:90%
And that flow monitor
called SW-MON identified

84
03:02.410 --> 03:04.667 align:middle line:84%
this exporter and this record.

85
03:04.667 --> 03:06.500 align:middle line:90%
And that's what we're
looking at right here.

86
03:06.500 --> 03:08.470 align:middle line:90%
So let's continue to
look at this exporter

87
03:08.470 --> 03:09.765 align:middle line:84%
object and this record object.

88
03:09.765 --> 03:11.140 align:middle line:90%
And the exporter
is going to have

89
03:11.140 --> 03:15.620 align:middle line:90%
the details for who do we ship
off this flow information to.

90
03:15.620 --> 03:16.810 align:middle line:84%
Where is the collector?

91
03:16.810 --> 03:19.150 align:middle line:90%
And the record object
is going to identify

92
03:19.150 --> 03:22.180 align:middle line:90%
when we see traffic inbound on
that interface what should we

93
03:22.180 --> 03:25.753 align:middle line:90%
pay attention to as far as
flow information is concerned.

94
03:25.753 --> 03:27.670 align:middle line:90%
So to take a look at the
exporter information,

95
03:27.670 --> 03:30.010 align:middle line:84%
we do a show run section flow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:27.670 --> 03:30.010 align:middle line:84%
we do a show run section flow.

96
03:30.010 --> 03:31.420 align:middle line:84%
And we'll type in export.

97
03:31.420 --> 03:32.500 align:middle line:84%
That'll be enough.

98
03:32.500 --> 03:33.550 align:middle line:84%
And here we go.

99
03:33.550 --> 03:36.150 align:middle line:90%
Looking at the exporter
information, here it is.

100
03:36.150 --> 03:38.980 align:middle line:90%
So we're looking for the
one called SW-EXPORT,

101
03:38.980 --> 03:41.210 align:middle line:84%
which is this guy right here.

102
03:41.210 --> 03:46.870 align:middle line:90%
So this is showing us the
transport protocol of 2055 UDP.

103
03:46.870 --> 03:50.680 align:middle line:90%
It's also specifying the IP
address of the collector,

104
03:50.680 --> 03:54.310 align:middle line:84%
that 172.20.30.201.

105
03:54.310 --> 03:55.900 align:middle line:84%
Fantastic.

106
03:55.900 --> 03:57.970 align:middle line:90%
It's also specifying
the export protocol

107
03:57.970 --> 04:01.510 align:middle line:90%
of IP fix, which we can call
version 10 affectionately.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:57.970 --> 04:01.510 align:middle line:90%
of IP fix, which we can call
version 10 affectionately.

108
04:01.510 --> 04:05.580 align:middle line:90%
Or if it said NetFlow version 9,
then it'd be NetFlow version 9.

109
04:05.580 --> 04:08.410 align:middle line:90%
So this flow monitor
called SW-MON identified

110
04:08.410 --> 04:10.123 align:middle line:90%
the exporter called
SW-EXPORTER, which

111
04:10.123 --> 04:11.290 align:middle line:84%
we're looking at right here.

112
04:11.290 --> 04:14.170 align:middle line:90%
It also identified the
record called SW_RECORD.

113
04:14.170 --> 04:17.529 align:middle line:90%
And that's indicating, when
traffic shows up on gig 0/3,

114
04:17.529 --> 04:20.410 align:middle line:90%
what should it look for, what
should it pay attention to

115
04:20.410 --> 04:22.300 align:middle line:90%
as it's recording
flow information.

116
04:22.300 --> 04:24.910 align:middle line:90%
And that's going be
detailed in this object

117
04:24.910 --> 04:28.150 align:middle line:90%
called the flow record
called SW_RECORD.

118
04:28.150 --> 04:29.770 align:middle line:84%
Let's take a look at that next.

119
04:29.770 --> 04:31.540 align:middle line:90%
And we can do that
with the Up Arrow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:29.770 --> 04:31.540 align:middle line:90%
And we can do that
with the Up Arrow.

120
04:31.540 --> 04:33.190 align:middle line:84%
Show run pipe section flow.

121
04:33.190 --> 04:36.660 align:middle line:90%
And we'll type in
record, and press Enter.

122
04:36.660 --> 04:39.840 align:middle line:90%
And the one we are
looking for is SW_RECORD.

123
04:39.840 --> 04:41.560 align:middle line:84%
And there it is right there.

124
04:41.560 --> 04:45.390 align:middle line:90%
So this flow record called
SW_RECORD, which is right here,

125
04:45.390 --> 04:48.720 align:middle line:90%
this whole thing is identifying
what we should pay attention

126
04:48.720 --> 04:51.600 align:middle line:90%
to, and what we should collect
as far as flow information

127
04:51.600 --> 04:55.210 align:middle line:90%
when traffic shows up on
that gig 0/3 interface.

128
04:55.210 --> 04:57.210 align:middle line:90%
Again, the big picture
of tying it all together,

129
04:57.210 --> 04:59.630 align:middle line:90%
the flow monitor is
applied to the interface.

130
04:59.630 --> 05:01.590 align:middle line:90%
In that flow monitor,
it's going to refer
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
04:59.630 --> 05:01.590 align:middle line:90%
In that flow monitor,
it's going to refer

131
05:01.590 --> 05:03.270 align:middle line:84%
to an exporter and a record.

132
05:03.270 --> 05:05.910 align:middle line:90%
The record objects says what
we should pay attention to,

133
05:05.910 --> 05:08.610 align:middle line:90%
and the exporter object says
where should we send it once

134
05:08.610 --> 05:10.220 align:middle line:84%
that information is collected.

135
05:10.220 --> 05:11.880 align:middle line:90%
So in troubleshooting,
if we're not

136
05:11.880 --> 05:13.560 align:middle line:90%
getting the
information we think,

137
05:13.560 --> 05:16.080 align:middle line:90%
we might want to verify that
we have the correct flow

138
05:16.080 --> 05:17.195 align:middle line:84%
records identified.

139
05:17.195 --> 05:19.320 align:middle line:90%
And if we're not getting
any data at the collector,

140
05:19.320 --> 05:21.690 align:middle line:90%
we'd want to make sure that
we have the parameters set up

141
05:21.690 --> 05:23.732 align:middle line:90%
under the exporter object
with the correct ports,

142
05:23.732 --> 05:26.358 align:middle line:90%
the correct IP address, make
sure we have routing in place,

143
05:26.358 --> 05:28.650 align:middle line:90%
and that we don't have an
axis control that's somewhere

144
05:28.650 --> 05:31.353 align:middle line:90%
between this router
and the collector that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:28.650 --> 05:31.353 align:middle line:90%
between this router
and the collector that

145
05:31.353 --> 05:33.270 align:middle line:90%
would be blocking that
traffic from showing up

146
05:33.270 --> 05:34.562 align:middle line:84%
at the collector.

147
05:34.562 --> 05:36.270 align:middle line:90%
Now, one of the benefits
of using NetFlow

148
05:36.270 --> 05:38.070 align:middle line:90%
is collecting this
data at the collector

149
05:38.070 --> 05:40.110 align:middle line:90%
and then analyzing it
with some software tool.

150
05:40.110 --> 05:41.610 align:middle line:90%
And that's what I'd
like to give you

151
05:41.610 --> 05:44.070 align:middle line:90%
a demonstration of in the
next video is that once

152
05:44.070 --> 05:47.150 align:middle line:90%
we have a bunch of devices that
are collecting information,

153
05:47.150 --> 05:48.900 align:middle line:90%
forwarding it over
to a collector, what

154
05:48.900 --> 05:50.070 align:middle line:84%
does that data look like?

155
05:50.070 --> 05:52.920 align:middle line:90%
Or what could it look like
with a NetFlow analyzer?

156
05:52.920 --> 05:54.540 align:middle line:90%
So that's coming up
in the next video.

157
05:54.540 --> 05:56.940 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

158
05:56.940 --> 06:00.200 align:middle line:90%
And I'd like to thank
you for viewing.