- [Instructor] Flexible NetFlow is a Cisco enhancement
that allows for more focused NetFlow data collection.
A big advantage is that it allows us
to use multiple flow monitors and exporters
on the same traffic simultaneously.
So for example, maybe your security team wants
to monitor traffic for anomalies
and perhaps your infrastructure team is only interested
in bandwidth utilization.
With Flexible NetFlow, you can configure
multiple flow policies for monitoring
the exact same traffic flow,
but those outputs would be separate.
They'd be split out, so that each team receives
the information only that's relative to their needs.
So rather than capturing everything,
we can get very specific with Flexible NetFlow.
Here you can see we're using the same topology
that we did in our traditional
NetFlow configuration example.
We have a router connected by gig0/1
to the 172.16.10.0/24 subnet
and we have an external NetFlow collector sitting
at 10.1.1.5.
The first thing we need to do when using Flexible NetFlow
is to define a flow record.
Now there are predefined flow records that we used
with traditional NetFlow or you can make
a custom flow record which we'll do in this case.
This is going to determine exactly
which type of traffic will be monitored on our networks.
So rather than collecting all of our network data metrics
as traditional NetFlow does, this is going to allow us
to be more specific.
So, let's go under first global configuration mode
on router one, and let's say flow record
and if we look at contextual help,
we see that we need to give this record a name.
I like to be fairly descriptive here,
so I'll call that host-record.
Once we hit enter, now notice we're under
flow record configuration mode.
If we look at contextual help, we can see those options.
And one really helpful thing that we can do here
is we can give this flow record a description.
When you start working with custom flow records,
it's really nice to have a description attached,
so that you're not wondering exactly
what each of those custom records is supposed to be doing.
Now this is an optional step,
but I think it's super helpful.
So let's say description and we can give that
some sort of text description,
so let me just say custom flow record
for host traffic.
So that's a fairly descriptive name for that.
I'll hit enter to accept that description.
And next, if we look at contextual help again,
the next option we want to use is the match keyword.
With customized flow records, there always has to be
at least one match statement,
and those match statements are pointed
to what are called key fields.
And the key field is simply a way
that the IP packet is identified with NetFlow,
so it helps us to group our packets together.
Remember that when we examined traditional NetFlow,
we looked at those seven attributes
that are used as key fields and we see those here as well.
So Flexible NetFlow is going to allow us
to pair down those options and select very specific
key fields rather than collecting everything.
If we look at contextual help again,
we can see those categories listed here.
A key field can be an interface, it can be a time stamp,
it can be an application field,
lots and lots of options for that.
In my case, I'm going to use the IP version
for destination address as my key field,
so I'll start by saying IPv4
and again we see our help options here.
I'm going to choose destination.
And again, we'll look at help.
We can choose an address, a mask, or a prefix.
In my case, I'm going to say address
and I'll hit enter to complete my match statement.
Now we can repeat this match statement
as many times as we want to add additional key fields
or additional attributes if that's desirable.
In this example, this is the only key field
that I'm going to configure, so let's move on
to the next step which would be to configure our collector.
We want to configure the collect command.
So we can do that with the collect keyword
and a quick look at contextual help.
Again, we see those available categories.
These categories for collecting are referred to
as non-key fields.
These identify the information that should be collected
and attached to the flow data.
So again, just to clarify that difference.
Key fields help identify and group our packets together
while non-key fields are going to determine
which stats we want attached to our flow records.
In my case, I'm going to say counter
and from those options you see
that we can collect bytes or packets.
I want to choose bytes and I'm going to hit enter
to complete the collect command.
Now again, we can run this command multiple times
as well if we want to add on to this custom record.
So we literally have hundreds of different variations
in our custom flow records that are going to be available
for configuration.
So, let's break out of here and let's do some verification.
Let's say show flow record and you can see that
this is actually going to show
if we use this generic show command,
we can see the original NetFlow record
used for traditional IP version four NetFlow
and in that output, you can see all of the different match
and collect statements.
So that's going to gather a lot of information.
And that's the reason why we might choose
to use a custom NetFlow record.
Maybe we don't want to collect all of that information.
Maybe we want to be much more specific.
So we can look at our custom record
by saying show flow record followed
by the name of the record that we've configured.
Which in our case was host-record,
and here we can see that output.
Notice we have a much shorter output.
We only see our single match statement
for the IP version four destination address
and the single collect statement
for the number of bytes collected by the counter.
So that looks good.
Now that we've configured that,
the next steps are fairly similar
to configuring exportation of flow records
with traditional NetFlow.
So we need to configure our exporter now.
Let's go back under global configuration mode
and let's say flow exporter and this is going to allow us
to define a custom export process.
Remember, we can setup multiple exportations
with all different kinds of data options.
So in order to do that, we need to separate
our exporter instances and we do that by creating them
and giving them a name.
So I'm just going to call this host-export
and now we're under flow exporter configuration mode.
The next thing we need to do is to point this
to our external NetFlow collector.
We can do that with the command destination
followed by the IP address of our collector
which in this topology is 10.1.1.5.
If we look at our contextual help options again,
we can see that the next thing we want to configure is
which version of NetFlow that we want to export with.
We do that with the export-protocol keyword,
so let's use that.
And if we look at our contextual help options
that are available there, we see versions five
and versions nine as before,
and also we see IP fix version 10.
IP fix is a derivative of NetFlow version nine,
and that's designed as a more open standard.
So that's certainly a valid option.
In this case, I'm going to choose NetFlow version nine
and hit enter to accept that.
If we use the transport keyword,
and we look at those options you can see
that we have only one possibility.
That's the option of using UDP.
So let's say UDP and then the next thing you see is a port.
We need to define a port value.
Again, you'll want to check with your NetFlow collector
that you use to see which ports
your specific solution listens over.
In this case, I'm going to choose one
of those very common ports that we see quite often
which is 9995.
There are a series of those fairly common ports,
so again check with your NetFlow collector manufacturer
to see which one will be relevant to you.
We can hit enter and then we can break out of there
and we can run the command show flow exporter
to take a look at that.
And here you can see all of the options
that we've configured previously in this output.
We see the name, host-export,
it tells us that this is user defined,
we see it's using NetFlow version nine,
the destination IP address is 10.1.1.5
which is our NetFlow collector,
we see it's using UDP port 995, so that all looks good.
Now, we've created a custom flow record
and we've created a custom flow exporter.
Now, we need to create our custom flow monitor.
This monitor is going to be applied to an interface
in order to perform the network traffic monitoring.
So let's go back under global configuration mode
and let's say flow monitor
and again we need to give that a custom name
which I'm going to make host-monitor.
And if we look at the options under there,
we again have the description option.
Again, that is an optional step
but it's something I like to do to make things easy
to identify, so I'll give that a short description,
used for custom flow record host-record.
So that's good.
I'll hit enter there.
If we look at our contextual help again,
we see the record keyword and this is going to allow us
to specify a specific flow record
that we want to use with this monitor.
If we look at our options, notice we have the option
of using traditional NetFlow, the original NetFlow,
or we can use our custom NetFlow that we've setup
which is exactly what we want to do here,
so I'll say host-record.
Now, an optional step that we could do.
We could setup things like the cash keyword,
and we could set timeout values.
All sorts of other things we could do here.
I'm not going to configure any of this,
but just know that those are options
that are available to you.
So now, we have all that configured,
we need to correlate our custom flow monitor
to the custom flow exporter.
This is going to tell the traffic being collected
by the flow record to be sent
to our external NetFlow collector at 10.1.1.5.
So we can use the exporter keyword here
and you can see from the help options
that we can only use those custom user defined exporters.
We don't have the option of using the default exporters,
so we'll identify that by name host-export
and we'll hit enter to complete that command.
Let's do a quick verification of this
with the show flow monitor followed
by the name host-monitor.
Here we can see this configuration, with the description,
we see the flow monitor is named host-monitor,
it's used for custom flow record
for the host-record that we setup,
we see the name of the record again listed here,
and so all of that looks good.
One thing you might notice is that it is listed as inactive.
That's because we haven't applied the NetFlow monitor
to any interface just yet, so let's do that.
Let's go under global configuration mode
and let's go under interface gig0/1
which is pointed to the subnet containing our hosts
and let's say IP flow monitor
and contextual help indicates that we need to call out
the name of that custom monitor
which is host hyphen monitor
and we can apply that in several manners.
In my case, I'm going to use the input keyword
to collect input traffic.
I'll hit enter and that completes
our Flexible NetFlow configuration.
I'm going to exit here and I'm going to go over
to one of our hosts, I'm going to do a quick ping
over to this router at 10.1.1.1 and we'll let that complete.
Then I'm going to jump back to the router
and I'm going to do another show command.
I'll say show flow monitor and the name of that
is host-monitor and I want to see the cache.
So here, we can see our custom Flexible NetFlow
configuration has a much more limited output than before.
We can see the match key field that we identified
which is the IP version four destination address
and the non-key field that we configured
which is the number of bytes in the counter.
So that's working just as we would expect.
Again, there are many, many options here for customization
with these NetFlow records.
We've only really scratched the surface here
by looking at a fairly simple example.
So, that's a look at configuring Flexible NetFlow.