Set up NBAR2 on Cisco devices

Network Based Application Recognition (NBAR) is the mechanism used by certain Cisco routers and switches to recognize a dataflow by inspecting some of the packets sent. NTA 2024.4.1 supports unknown traffic detection and advanced application recognition through NBAR2.

First, configure your Cisco devices to send NBAR2 data to NTA. Second, add those devices as nodes in NPM and NTA.

The following values are examples used in the commands below:

• NTArec
• NTAexp
• NTAmon
• GigabitEthernet0/1
• 10.10.10.10

Create a new Flexible NetFlow configuration

Add the flow record

This process is similar to creating a standard NetFlow configuration. In this case, you add the collect application name command to enable the sending of AppID in each flow.

flow record NTArec
	match ipv4 tos
	match ipv4 protocol
	match ipv4 source address
	match ipv4 destination address
	match transport source-port
	match transport destination-port
	match interface input
	collect interface output
	collect counter bytes
	collect counter packets
	collect application name
exit

Add the flow exporter

The option application-table command enables the sending of a list of applications that can be classified using NBAR2, including applications that were manually created. The option application-attributes command enables the sending of categories for all applications.

flow exporter NTAexp
	destination 10.10.10.10
	source GigabitEthernet0/1
	transport udp 2055
	export-protocol netflow-v9
	template data timeout 60
	option application-table timeout 60
	option application-attributes timeout 300
exit

Add the flow monitor

The flow monitor connects the flow recorder and the flow exporter. You can configure multiple recorders, exporters, and monitors at once.

flow monitor NTAmon
	description NetFlow nbar
	record NTArec
	exporter NTAexp
	cache timeout inactive 30
	cache timeout active 60
exit

When receiving long flows, these values may need to be adjusted, see Troubleshoot Long Flow Errors in NTA for more details. For more information about the timeout values, refer to the Cisco NetFlow Command Reference.

Apply the monitor to an interface

Assign the Flexible NetFlow configuration to the interface from which to monitor NetFlow.

interface GigabitEthernet0/1
	ip flow monitor NTAmon input
	ip flow monitor NTAmon output
exit

Diagnostic commands

show flow record "recordName"
show flow export "exporterName"
show flow monitor "monitorName"
show flow exporter statistics
show flow interface

Determine the applications your device can recognize

The Protocol Pack is a list of applications, definitions, and categories that your device can recognize.

Check the Protocol Pack version

show ip nbar version

View a list of the available applications

show ip nbar protocol-id

Edit an existing record

If you edit an existing record that is in use, you receive the following error:

% Flow Record: Flow Record is in use. Remove from all clients before editing.

To resolve this error, remove the connection between the monitor, record, and interface.

Disable the connection

interface GigabitEthernet0/1
	no ip flow monitor NTAmon input
	no ip flow monitor NTAmon output
exit

Add the application recognition field into the record

flow record NTArec
	collect application name
exit

Add the application recognition field into the exporter

flow exporter NTAexp
	option application-table timeout 60
	option application-attributes timeout 300

Restore the connection

interface GigabitEthernet0/1
	ip flow monitor NTAmon input
	ip flow monitor NTAmon output
exit