Flexible NetFlow greatly changed the way we use NetFlow
by making NetFlow customizable and modular.
Now we really have three pieces that we configure
to identify ultimately how we configure NetFlow.
We're gonna start by talking about the record.
The record is the first piece of NetFlow
in flexible NetFlow configuration.
This is where we specify what our match conditions are. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
This is where we specify what our match conditions are.
When do we want to collect a flow?
When we are looking for a source IP,
destination IP, source and destination port,
application details, and so on.
This is setting the criteria for when we want to hold a flow WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
This is setting the criteria for when we want to hold a flow
in cache to be exported.
That's the first thing.
The second thing, not too surprisingly,
is our exporter configuration.
Not much has really changed there.
You saw how we did that in the previous video.
The third piece is the monitor, which combines the two.
Then we attach the monitor to an interface WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Then we attach the monitor to an interface
to begin using the actual NetFlow configuration.
The reason why this is cool is that we can set up
different records and different exporters
and apply them in a monitor to different interfaces
all on the same device.
Now we can capture specific flows for specific interfaces
for specific exporters and run them all in parallel WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
for specific exporters and run them all in parallel
side by side with each other on the same switch
or the same router.
That's what makes this flexible.
Now we have control over what is a flow,
where does it go, and what interface
is that particular setup going to be set up to.
So we can have one record but multiple exporters,
or we could have multiple exporters in one record,
or we could have multiple of each,
and we can set up different monitors
for each combination of those, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
for each combination of those,
and then apply them to an interface to be used.
Let's take a look at how this configuration really works.
Let's go into configuration mode
and then create our first flow record.
We'll give it a name, because that's what comes next,
so let's call it something like FNF,
for forwarding net flow, and I'll call this record,
like so.
Now we can see I'm in the flow record configuration.
This is where we set up our match statements. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
This is where we set up our match statements.
So I can say match only the IPv4 protocol,
just like this, we'll do match IPv4,
and I type match twice, that's why it doesn't like that.
Match IPv4, it should be match IPv4 protocol,
there we go, and that's my first match statement.
If I wanna say match the source,
source, come on now. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Oh, I'm getting too far ahead of myself,
because I keep looking at this context-sensitive help
for match IPv4.
Let's do match IPv4 source address,
let's do match IPv4 destination address,
that's data that I want to know here.
We'll match, let's go back here, match the transport,
let's see, is it source address or transport?
Yeah, source port. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Yeah, source port.
Let's match transport destination port.
Notice you can say only match things like TCP, UDP,
ICMP, or IGMP here as well.
And then, now that I've got all these match statements set,
I've got IPv4 protocol, source address,
destination address, source port, destination port,
what do I wanna do with it?
We can start collecting things, like collect counters.
So if I say just collect counters WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
So if I say just collect counters
on these interfaces right there, counter,
and then we can say packets,
we can do collect counter bytes, like that.
Maybe I wanna know when this flow started,
so I'll do collect timestamp absolute first, right there,
that's the first time we saw this flow.
We can also see when did it stop,
we can do absolute last, it should be able to do last, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
we can do absolute last, it should be able to do last,
let's make sure that that's right, absolute,
yeah, last, right there, absolute last, like so.
So now I've configured a flow record.
So I will exit out of this flow record
and immediately go to start configuring my flow exporter.
Let's call this flow exporter,
we'll call this for the NetFlow FNF,
let's call this export, like so, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
let's call this export, like so,
and now I'm in the exporter configuration.
What's the destination here?
We can do, let's hit a question mark here
and see what we've got.
Destination configuration is gonna be
with just an IP address, IPv4 or IPv6,
or it can go by host name, I'll do 123.4,
and you might be thinking, wait a minute,
like you're not specifying the port number, that's right.
This time we have export protocol
and here we can say NetFlow version nine. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
and here we can say NetFlow version nine.
Notice we also can set IP fix from here too.
So we can do either NetFlow version nine
or IP fix from this particular configuration.
We weren't able to do that from the previous video,
it only allowed me to use version nine.
When we use flexible NetFlow,
we can actually start using IP fix.
I can also say my transport protocol is going to be UDP
and then we say the port 6783. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
and then we say the port 6783.
We can say my source is gonna be loopback zero,
like so there.
The last piece of this puzzle is to exit out
and configure a monitor that connects these two together.
So we'll do flow monitor, we'll call it FNF monitor,
like so, and now we're in the monitor configuration
and this is where we bind the record
and the exporter together.
That is as simple as saying record, FNF record, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
That is as simple as saying record, FNF record,
exporter, FNF, did we call it export?
I think we just called it export,
let's scroll up just a hair.
Yeah, FNF export, there we go.
So that's the configuration of the monitor.
The final thing to do then
is to exit out of that configuration
and apply it to an interface like gig zero zero.
We'll say from this interface IP flow monitor, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
We'll say from this interface IP flow monitor,
the name of our monitor was FNF monitor.
We can call it in to capture flows as they go inbound.
We can also say output to capture flows as it goes out
and that's it.
That's how you configure flexible NetFlow
to start collecting flows and sending them out
to your NetFlow collector.
I think strongly that using flexible NetFlow
in conjunction with version nine or IP fix WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
in conjunction with version nine or IP fix
is definitely the way to go.
And at this point, we've now covered
how to troubleshoot your network leveraging things
like logs, debugs and NetFlow.