CloudLabBox
Try the free demo

CCNP ENCOR lab 25 of 36

Flexible NetFlow and ERSPAN on IOS XE

On Fernhill's IOS XE branch router, record who talks to whom with Flexible NetFlow and export it to a collector, then mirror the branch LAN across the routed WAN to a Linux analyser with ERSPAN.

Run this lab

It needs Lite: its 4 nodes are set to 5 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 25 - Flexible NetFlow and ERSPAN on IOS XE

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
5 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Fernhill Freight's Bristol branch router (BR1) runs IOS XE. The network operations centre (NOC) at HQ wants two things from it:

  1. Flow data: who talks to whom, on which ports, and how much, exported every minute to the NOC collector (10.10.50.100, UDP 2055) in NetFlow version 9.
  2. Packet copies: a remote copy of everything on the Bristol LAN interface, delivered over the routed WAN to the NOC's analyser, because nobody wants to drive to Bristol with a laptop.

HQ pings PC1 from its server-farm address every two seconds (IP SLA 1), so there's always traffic on the Bristol LAN.

DeviceInterfaceAddress
BR1 (CSR, IOS XE 17.3)Gi1 (WAN) / Gi2 (LAN)10.0.12.1/30 / 10.20.10.1/24
HQGi0/0 / Gi0/1 / Lo1010.0.12.2/30 / 10.10.50.1/24 / 10.10.30.1/24
PC1eth010.20.10.10/24, gateway 10.20.10.1
NOC (Linux)eth010.10.50.100/24, gateway 10.10.50.1

Topology: PC1 — BR1 — HQ — NOC.

What you’ll practise

  • Explain flow records, key and non-key fields, exporters and monitors in Flexible NetFlow
  • Configure a custom flow record, an exporter and a monitor, and apply it to an interface
  • Read the flow cache and exporter statistics, and see NetFlow v9 packets arrive at a collector
  • Configure an ERSPAN source session and capture the GRE-encapsulated copies on a remote host

The tasks

  1. Prepare the NOC host
  2. Plan the flow record
  3. Build the record, exporter and monitor
  4. Apply the monitor and read the cache
  5. See the exports arrive
  6. Mirror the LAN with ERSPAN

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Flexible NetFlow and ERSPAN on IOS XE4 nodes, 3 links. Every link is listed as text below the diagram.BR1HQPC1NOCeth0Gi2Gi0/1eth0Gi1Gi0/0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • PC1 eth0 to BR1 Gi2
  • BR1 Gi1 to HQ Gi0/0
  • HQ Gi0/1 to NOC eth0
Nodes in Flexible NetFlow and ERSPAN on IOS XE, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
BR1Cisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial2 vCPU, 4,096 MB
HQCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
NOCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 25 - Flexible NetFlow and ERSPAN on IOS XE and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.