NBAR2 configuration

10/19/2018 1:41 AM

6/16/2025 4:05 PM

This document will briefly describe the NBAR2 configuration on Cisco devices and some of useful diagnostics commands.

Netflow Traffic Analyzer

NBAR2 is part of Flexible Netflow (FNF) configuration, to have correctly configured FNF one needs to configure all three parts: recorder, exporter and monitor.

The Following represents the recommended configuration:

 

1. Recorder:

 flow record SolarwindsNetflow

 match ipv4 tos

 match ipv4 protocol

 match ipv4 source address

 match ipv4 destination address

 match transport source-port

 match transport destination-port

 collect transport tcp flags

 collect interface input

 collect counter bytes long

 collect counter packets long

 collect timestamp sys-uptime first

 collect timestamp sys-uptime last

 collect application name

For NBAR2 is crucial the command "collect application name" - this will enable the sending of AppID in each flow.

2. Exporter:

 flow exporter SolarwindsNetflow

 destination 10.140.27.226

 source GigabitEthernet0/1

 transport udp 2055

 template data timeout 60

 option application-table timeout 60

 option application-attributes timeout 300

For NBAR2 the important command is "option application-table" - this will enable the sending of a list of all applications that can be classified using NBAR2 included those manually created. Here with timeout 60 seconds.

Command "option application-attributes" will enable sending the categories for all applications. Here with 300 seconds timeout.
 

3. Monitor:

 flow monitor SolarwindsNetflow

 exporter SolarwindsNetflow

 cache timeout active 60

 record SolarwindsNetflow

This basically interconnects the flow recorder and flow exporter. There can be configured more than one exporter, recorder and monitor in one time.

 

Then the configuration of course has to be assigned to interface which we want to monitor Netfow from.

 

4. Interface:

 

 interface GigabitEtherent 0/0/1

 ip flow monitor SolarwindsNetflow input

 ip flow monitor SolarwindsNetflow output

For diagnostic purposes it is useful to use following commands:

show flow record "recordName"

show flow export "exporterName"

show flow monitor "monitorName"

show flow exporter statistics

show flow interface

The number of application device is able to recognize depends on Protocol Pack that the device has installed. The Protocol Pack is basically list of applications and their definitions and categories that the device is able to recognize. The Protocol Pack is continuously being updated by Cisco. Each new version typically brings couple of new applications that the router is able to recognize/report.

For checking current installed Protocol Pack issue following command:

show ip nbar version

Output:

NBAR software version:  20
NBAR minimum backward compatible version:  20
    
Loaded Protocol Pack(s):
    
Name:                            Advanced Protocol Pack
Version:                         14.0
Publisher:                       Cisco Systems Inc.
NBAR Engine Version:             20
Creation Time:                   Wed Mar 25 13:17:24 UTC 2015
File:                            flash0:pp-adv-isrg2-154-3.M2-20-14.0.0.pack
State:                           Active

The currently installed Protocol Pack is in version 14. Protocol Pack can be dependent on IOS version, so it could happen that before installing new Protocol Pack user will have to upgrade his IOS first.

A List of all available applications can be viewed after issuing following command:

show ip nbar protocol-id

Flow with Application ID:

If the application attributes are configured(command "option application-attribute"), device periodically sends list of attributes for all applications in following format: