300-410 ENARSI: Implementing Cisco Enterprise Advanced Routing and ServicesDemo

By Cisco · Question Mode

QuestionQ16

Infrastructure Services

Question Image

Refer to the exhibit. An engineer configured NetFlow but is unable to receive flows from R1. Which two configurations resolve the problem?

Choose two
  • A R3(config)#ip access-list extended DDOSR3(config-ext-nacl)#5 permit udp any host 10.66.66.66 eq 1090
  • B R4(config)#flow exporter FlowExporter1R4(config-flow-exporter)#destination 10.66.66.66
  • C R3(config)#flow exporter FlowExporter1R3(config-flow-exporter)#destination 10.66.66.66
  • D R1(config)#flow exporter FlowExporter1R1(config-flow-exporter)#destination 10.66.60.66
  • E R4(config)#ip access-list extended DDOSR4(config-ext-naci)#5 permit udp any host 10.66.66.66 eq 1090
Explanation

R1 exports NetFlow records as UDP packets to 10.66.66.66 on destination port 1090, but its UDP source port is 54186. The applied DDOS ACL denies UDP traffic in the 1024–65535 range, so it blocks those export packets on either route. A permit for UDP traffic to host 10.66.66.66 on port 1090 must be added before the deny entry on both R3 and R4, which cover the secondary and primary paths. Cisco documents that a flow exporter’s UDP transport setting identifies the destination system’s listening port, and extended ACLs can filter UDP ports. Cisco Flexible NetFlow output features Cisco IP Access List Overview

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!