ℹ️ Document Conversion Notice: This document has been converted from PDF and formatted to fit this screen. Diagrams and images may be available only in the original here.

Configuring and Troubleshooting NetFlow for Cisco Stealthwatch

Introduction

This document provides essential guidance on configuring Cisco network devices to export NetFlow data to Cisco Stealthwatch. It details the process for collecting and analyzing network telemetry to enhance security and visibility.

Cisco Stealthwatch Overview

Cisco Stealthwatch is a powerful security analytics solution that leverages machine learning and entity modeling to detect advanced threats, accelerate threat response, and provide comprehensive visibility across enterprise networks and cloud infrastructures. It analyzes network traffic data, including NetFlow, to identify anomalies and policy violations.

NetFlow Configuration Steps

The document outlines the key steps for configuring NetFlow on Cisco devices for Stealthwatch integration:

Defining a Flow Record
Configuring a Flow Exporter
Configuring a Flow Monitor
Applying the Flow Monitor to interfaces

It provides specific configuration examples for various Cisco platforms like Cisco IOS, Catalyst switches, Nexus switches, and ASA firewalls.

Troubleshooting

Guidance is offered on troubleshooting common NetFlow export issues, including problems with exporter configuration, data transport, and template mismatches. It details how to use Stealthwatch tools and logs to diagnose and resolve these issues.

Resources

Google Docs
Google Drive
Download [pdf]

File Info : application/pdf, 20 Pages, 1.30MB

config-trouble-netflow-stealth iText 2.1.7 by 1T3XT

Related Documents

	Cisco Secure Network Analytics Zeek Configuration Guide 7.5.3 This guide details the configuration of Zeek telemetry within Cisco Secure Network Analytics (formerly Stealthwatch) version 7.5.3 and later. It covers initial setup, advanced settings, verification steps, and evaluating Zeek events and logs.
	Cisco Secure Network Analytics System Configuration Guide 7.5.3 A comprehensive guide for configuring Cisco Secure Network Analytics (formerly Stealthwatch) version 7.5.3. This document details the setup and management of various appliances, including Managers, Data Nodes, Flow Collectors, Flow Sensors, and UDP Directors, to establish a secure and visible network environment.
	Cisco Nexus Dashboard Insights User Guide, Release 6.0.1 This user guide provides comprehensive information on Cisco Nexus Dashboard Insights, Release 6.0.1, designed for Cisco DCNM. It covers setup, features like Assurance Analysis, Bug Scan, Explore, and Netflow, along with troubleshooting and best practices for network monitoring and analytics.
	Cisco NX-OS SPAN Configuration Guide A comprehensive guide to configuring Switched Port Analyzer (SPAN) sessions on Cisco NX-OS devices, covering sources, destinations, limitations, and configuration examples for various Cisco Nexus platforms.
	Cisco Switch Guide: Comprehensive Overview of LAN Switching Solutions An overview of Cisco's extensive LAN switch portfolio, detailing modular, fixed-configuration, blade, and virtual switches for campus, branch, and data center networks. Highlights scalability, intelligence, and advanced features.
	Cisco Nexus Data Broker Configuration Guide, Release 3.1 This guide provides comprehensive instructions for configuring and managing the Cisco Nexus Data Broker software, including installation, setup, traffic aggregation, and system management. It covers various Cisco Nexus switch models and deployment modes.
	Cisco Secure Cloud Analytics: On-Premises Device, Hostname, and IP Mapping Guide Explore how Cisco Secure Cloud Analytics maps on-premises devices, hostnames, and IP addresses. This guide details integration methods, system limitations, and answers common questions for enhanced network visibility and security.
	Cisco Secure Network Analytics v7.5.3 Release Notes This document provides detailed release notes for Cisco Secure Network Analytics version 7.5.3, covering new features, improvements, bug fixes, known issues, hardware support, and contact information.