Configuring Flexible NetFlow NBAR has been discussed in our blogs before, but it’s still such a hot topic, I thought it warranted more coverage.

With NetFlow v9 Flexible NetFlow support, configuring the export of NBAR information to your NetFlow collector is simple to do by following these four steps.

4 Simple Steps

1. Define Flow record – creates the record, need to define the record characteristics

flow record nbar-record

match application name – This exports the NBAR application IDs.

The match application name option option is critical for NBAR reporting.  match application name is what provides the translation from the Protocol IDs and the more meaningful Application Name using the Protocol ID list.

 

2. Define Flow exporter – creates the exporter, defining the source interface and destination for the flows

flow exporter export-to-scrutinizer

option application-table timeout 60 – sets timeout to 60 seconds, default is 10 minutes

The option application-table timeout 60 entry so that the Protocol ID list template will be sent every 60 seconds to your NetFlow collector.

3. Define Flow monitor – configures the connection between the flow record and flow exporter

flow monitor nbar-monitor

4. Apply Flow monitor to interface(s) – associates the flow monitor to the selected interface(s)

interface fa0/0

ip flow monitor nbar-monitor input

In the ip flow monitor entry above,  ‘input‘ refers to ‘ingress‘.  For NBAR reporting, ingress is all that’s required to get the Application information.

For more detail on how to configure FNF NBAR, see Brad Reese’s article on www.networkworld.com.

Protocol ID List

The “show ip nbar protocol id” command will display the list of Application Names/Protocol IDs included on your router/switch.

show ip nbar protocol-id

If you have Applications that are not defined in this Protocol ID list, you can easily create custom NBAR applications as shown in this example, defining the GoToMeeting application.

Define Custom Protocol

NBAR Reporting

Then, once you have FNF NBAR configured to export to your favorite NetFlow Analyzer tool, the data can be viewed in reports such as the Applications NBAR report below.

NetFlow NBAR reporting

Future Support?

And just for the record, since we’ve been asked this question frequently, the Cisco ASA does not currently support NBAR.  Might be something you want to hound your Cisco rep about, eh?

Joanne Ghidoni author pic

Joanne Ghidoni

Joanne is a Software Quality Assurance Engineer at Plixer. She has also held positions as Technical Support Engineer and Sales Engineer since joining Plixer in 2005. Prior to joining Plixer, Joanne has had numerous positions in the IT field, including data entry, computer operator, PC coordinator and support, mainframe programmer, and also Technical Support and web programmer at Cabletron Systems. In her spare time, Joanne enjoys traveling, always seeking out new and interesting places to visit.

Related

Big Data

Sankey Flow Graph

One of the greatest benefits of NetFlow collection for traffic analysis, is we’re provided with the ability to visualize the…

Leave a Reply