- We're going to take a look now at how we can configure
Netflow on this Cisco router.
You can see that we have a subnet of hosts
on the 10.1.1.0/24 network
and that's connected to Gig 0/1 on our router.
And we have our Gig 0/2 interface
connected to a NetFlow collector.
This collector could be any number of collector tools
that are available, things like SolarWinds,
or PRTG just to name a couple of those options,
but first we'll configure our ingress interface
Gig 0 / 1 on this router for NetFlow capture.
And we'll take a look at our local NetFlow Cache
and then we can look at how to configure the router
for exporting those records.
You can see from the topology that our collector
is sitting at 192.168.10.5.
First on Router 1, let's go under Global Configuration Mode.
And the first thing we can do
is we can say, "IP flow - export"
and let's look at contextual help.
You can see from there that we have the option
to choose the version for NetFlow.
So let's use the keyword Version
and if we look at help again, we see one, five
and nine available.
And I'll point out specifically Versions five & nine.
Now Version one is obsolete
and that's limited to IP Version four without network masks
and autonomous system numbers, so want to choose five or nine
and Version five is by far the most popular
because of the legacy support
and the fact that the format of the exported data
it's always the same, so many older collectors
can handle this version much easier.
At the time of this recording, Version 9
is the most current version and it adds a lot of features
that we discussed in our Netflow Theory video,
things like added security features.
So in this case I'm going to choose Version nine
by using the number nine keyword
and I'll hit Enter.
Now we can go under the interface
where we want to capture NetFlow data.
So we'll go under that interface
just as if we were configuring an IP address
on the interface so I'll say, "Interface Gig 0/1,"
and we're under that interface now for configuration
which is the Ingress interface for the 10.1.1.0/24 subnet
where our hosts are located.
Under here we can use the keywords IP Flow
and if we look at contextual help,
we have three options here.
We have Ingress, Egress and we have Monitor.
The monitor option is going to be used with flexible NetFlow
which we'll examine in a future video.
So in this example, we're actually going to configure
both of the remaining options here
so that we're able to capture data related to traffic
both coming from and going to the 10.1.1.0/24 subnet.
So I'll say, "IP Flow Ingress,"
and I'll use that command again
but this time I'll say, "IP Flow Egress"
and that's it, simple as that.
Now NetFlow is going to capture data from this interface
and store that in the NetFlow Cache.
Let me exit and we can verify this configuration
with the command Show IP Flow interface.
And that command is going to show us every instance
where we have NetFlow configured for an interface.
So in our case,
that is only on the Gigabit Ethernet 0/1 interface.
We can also see that we have that configured
for both Ingress and Egress traffic so that's good.
Now just to make sure that we have some traffic crossing
that interface, I want to jump over to PC one,
one of our hosts and I want to ping the router.
So I want to ping 10.1.1.1 and I'm going to do the same thing
from our other hosts as well,
just pinging that router's Ingress interface.
So that's good, all three of those were successful.
Now, back on the router, I also am going to ping
in the direction of the host,
just so we have record of that traffic
so I'll say, "Ping 10.1.1.10," which is PC 1,
dot 11 is PC two
and dot 12 is PC three.
Now, let's run the command Show IP Cache Flow.
We're going to see several things here.
Remember that if we don't configure a NetFlow export,
this information is going to be stored
only in the Local Netflow Cache.
Again, you can do this even with a collector configured
and this local cache
is a great way to see some immediate information in the CLI
if you're actively troubleshooting.
It's not ideal for a historical perspective in your network
but certainly useful in many cases.
And that's what we're actually looking at here.
What we see first near the top
is the packet distribution size.
We can see we had a total of 30 packets listed
and the distribution size it's telling us 100% of those
are within this range between 96 and 128 bytes.
That's exactly what I would expect,
because if you remember, ICMP messages by default
are 100 bytes each, so 100% of those
are represented in that range.
We also see that we have
three active flows.
And if we look a bit further down than that
we'll also see that inactive flows,
it tells us that those time-out in 15 seconds.
So if we actually run this command again
and let me actually do that so we can take a look at that.
If we say, "Show IP Cache Flow again,"
notice now it tells us we have zero active flows
at the moment.
And that's because of that 15-second inactive flow time-out
that happens.
And just above that we also see that even active flows
will time-out in 30 minutes.
And so this is a way that the router
helps keep the NetFlow Cache clear and recent.
So if we want to see those active flows,
we'll need to have fairly recent and active traffic,
maybe something like a continuous ping
if we're simulating that in our lab
or we'll want to be really quick
with our show commands as I was.
Now of course the overall goal, the end goal
would be to configure an external collector
that's going to keep those indefinitely for us.
Now, if I scroll back up to the first output,
where we had those three active flows listed there,
we can see that the source interface here is Gig 0/1.
We see the Source IP address
and we also see the Destination IP address,
the destination being our router interface
and we see a total of five packets at the end,
listed at the very end of that output.
And if we want to manually clear this by the way,
we can manually clear our NetFlow Cache
by running the command Clear IP Flow Stats.
So if we do that and if we again say, "Show IP Cache Flow,"
you'll notice that our database is now empty.
We don't have any distribution size, we have zero packets,
we have nothing active,
so that's the way that we can manually clear that cache.
Now, if we want to export our NetFlow data
to an external collector which is again best practice,
we can do that very easily.
So let's go back under Global Configuration Mode
and let's again say, "IP Flow - export."
And if we look at contextual help,
one of those keyword options is Destination.
And that's certainly what we want to use
and we would follow that with the IP address
for our NetFlow collector server.
In our case if we look at our topology,
that IP address is 192.168.10.5.
One more time we'll look at contextual help
and the final thing that we need to do
is to indicate a port number.
Now there are several common UDP ports
that are used by default,
just depending on the collector that you've chosen.
I'll use nine nine nine five in this case.
Some of those common preferred ports include this one,
nine nine nine five also nine nine nine six,
2055, several several port options,
but you'll definitely want to check with your collector
to make sure of which ports that it specifically listens on.
If I hit Enter, I'll quickly jump back to a host
and I will again ping our router.
I'll go back to the router again and I'll do the same,
Show IP Cache Flow command
and we will see those stats in there.
I'll also say, "Show IP Flow export."
So, now you can see that there were two flows
exported in one UDP Datagram.
And again remember those are unidirectional flows
and that's why we see two of those represented here.
Underneath that we would also be able to see any issues
with export failures due to things like adjacency issues
or fragmentation or several other cases that are listed.
On the collector side, this data would all be aggregated
and sorted and we'd have some really nice graphical outputs
that are going to help us interpret exactly what's happening
within our network.
So that's a look at how we can capture NetFlow data
to our local Netflow Cache
and also how we can export that
to an external Netflow collector.