Question 811 - 350-401 discussion

Option C is the correct set of commands to apply flexible NetFlow on a group of switches with the given requirement.The configuration steps are as follows12:

Define a flow record that specifies the fields to be collected and exported for the flows. In this case, the flow record is namedFNF-RECORDand it collects the source and destination IP addresses, the input and output interfaces, the transport protocol, and the source and destination port numbers:flow record FNF-RECORDandmatch ipv4 source address,match ipv4 destination address,match interface input,match interface output,match transport protocol,match transport source-port,match transport destination-port.

Define a flow exporter that specifies the destination and transport protocol for sending the flow data. In this case, the flow exporter is namedFNF-EXPORTERand it uses UDP port 9996 to send the flow data to the IP address 10.10.10.10:flow exporter FNF-EXPORTERanddestination 10.10.10.10,transport udp 9996.

Define a flow monitor that applies the flow record and the flow exporter to the monitored traffic. In this case, the flow monitor is namedFNF-MONITORand it uses the flow recordFNF-RECORDand the flow exporterFNF-EXPORTER. It also sets the cache timeout for inactive flows to 20 seconds, which means that the flow sample will be exported if the flow is idle for 20 seconds:flow monitor FNF-MONITORandrecord FNF-RECORD,exporter FNF-EXPORTER,cache timeout inactive 20.

Apply the flow monitor to the interfaces that need to be monitored. In this case, the flow monitorFNF-MONITORis applied to the input and output direction of the interface GigabitEthernet0/1:interface GigabitEthernet0/1andip flow monitor FNF-MONITOR input,ip flow monitor FNF-MONITOR output.

Option A is incorrect because it does not set the cache timeout for inactive flows to 20 seconds, which is required by the question.The default cache timeout for inactive flows is 15 seconds1.

Option B is incorrect because it does not apply the flow monitor to the output direction of the interface, which is required to capture both incoming and outgoing traffic on the interface1.

Option D is incorrect because it does not use a flow record to specify the fields to be collected and exported for the flows, which is required to customize the flow data according to the user's needs1.Reference:1:Configuring Flexible NetFlow,2:Flexible NetFlow Configuration Guide