300-410 ENARSI: Implementing Cisco Enterprise Advanced Routing and Services

R1 exports NetFlow records as UDP packets to 10.66.66.66 on destination port 1090, but its UDP source port is 54186. The applied DDOS ACL denies UDP traffic in the 1024–65535 range, so it blocks those export packets on either route. A permit for UDP traffic to host 10.66.66.66 on port 1090 must be added before the deny entry on both R3 and R4, which cover the secondary and primary paths. Cisco documents that a flow exporter’s UDP transport setting identifies the destination system’s listening port, and extended ACLs can filter UDP ports. Cisco Flexible NetFlow output features Cisco IP Access List Overview