Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1209 / 2086

45-15
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 45 Configuring AVC with DNS-AS
Configuring AVC with DNS-AS
Configuring FNF for AVC with DNS-AS
With FNF, you can gain visibility into the applications running on your network, and use FNF option
templates to export application ID, description, and attribute information.
You must configure these FNF settings on the DNS-AS client:
• Configure a flow record to collect nonkey field application-name , and the key fields ipv4 source
address and ipv4 destination address
•
Configure a flow exporter and the two option templates, to fetch application information.
Option template application-table , exports only applications resolved by the DNS-AS client, that
is, the application ID and name from the binding table. The corresponding application descriptions
come from Network Based Application Recognition (NBAR) definition for standard applications. A
constructured help string is used for custom applications.
Option application-attributes fetches attribute information by mapping it to the application name.
Where standard application names are used, the option template uses standard NBAR attribute
definitions; where custom application names are used, user-defined application names and only
certain attribute fields are guaranteed to carry values.
• Configure a flow monitor and apply it to an interface to enable network traffic monitoring.
FNF Interaction with DNS-AS—With every flow that is created in the flow table, the DNS-AS client
resolves the application name for the flow (if the entry exists in the binding table), by using the
destination IP address (and if not available), the source IP address.
At periodic, configured intervals (600 seconds, by default), FNF exports option template data, that is
mapped to the corresponding application name, to an external collector.
For more informattion about FNF, see the Configuring Flexible NetFlow chapter in this guide.
These sections provide more information:
•
Option Templates, page 45-15
• Sample FNF Configuration for AVC with DNS-AS, page 45-17
Option Templates
The application-table and application-attributes options templates are supported. These templates
determine the information that will be exported to an external collector.
option application-table
Exports the application name, application tag, and description to the external collector.
On a device where AVC with DNS-AS is enabled, only applications resolved by the DNS-AS client are
exported. But in addition, the application-table template exports two applications called
unclassified and
unknown , irrespective of whether the feature is enabled or not.
• Application Name—For custom and standard applications, this information is derived from the TXT
response (
app-name :
) that is saved in the binding table.
•
Application Tag—This is same as application ID in the context of the AVC with DNS-AS feature
and consists of the engine ID and selector ID.
– Engine ID or Classification Engine ID—Defines the context for the selector ID. Only these
values are supported:
L3—IANA layer 3 protocol number (IANA_L3_STANDARD, ID: 1)