- [Tutor] You can enable NetFlow on network devices
at all layers of the network,
to record and analyze all network traffic,
and identify threats such as malware
that could be spreading laterally
through the internal network.
In other words, malware that spreads between adjacent host
in the network.
Note that as a best practice, NetFlow should be enabled
as close to the access layer as possible.
This means the user access layer, data center access layer,
and VPN terminal points.
Another best practice is that all NetFlow records
belonging to a flow should be sent to the same collector.
You can also deploy NetFlow in the internet edge
to see what traffic is knocking on your door,
and what is leaving your network.
The Cisco ASR 1000 series routers
provide multi-gigabit performance
to meet the requirements for internet gateway functions
for medium and large organizations.
The architecture of the Cisco ASRS
include the Cisco QuantumFlow Processor
that provides a lot of high performance features
such as application layer gateways,
all layer four and layer seven
zone based firewall session processing,
high speed NAT and firewall translation logging,
as well as NetFlow Event Logging.
NetFlow Event Logging, otherwise known as NEL,
uses NetFlow version nine templates
to log binary syslog to NEL collectors,
allowing not only the use of NAT at multi-gigabit rates,
but also the ability to record NAT
and firewall session creation
and tear down records at very high speeds.
So let's jump in.
First, we log into our switch and enter the enable command.
Then we enter configuration mode.
The first thing we're going to do is create a flow record.
We can add an optional description here as well.
Next, we need to configure the key fields for the flow
using the match command,
and the non-key fields using the collect command.
I'll speed this video up
as there are a number of commands to enter here.
Once we finish up adding these commands
to the flow record configuration,
we will move on to configure the flow exporter
with the flow exporter command.
In this, we will define the destination
of our NetFlow Exporter.
From here, we move on to configure the flow monitor.
Here, we define the flow record and exporter we created,
and we also set a cache timeout.
Finally, we will apply the flow monitor to an interface.