300-710 · Question #120
An administrator is setting up Cisco Firepower to send data to the Cisco Stealthwatch appliances. The NetFlow_Set_Parameters object is already created, but NetFlow is not being sent to the flow…
The correct answer is D. Add the NetFlow_Add_Destination object to the configuration. Even if NetFlow parameters are configured on a Cisco Firepower device, NetFlow data will not be sent to a collector like Cisco Stealthwatch until a NetFlow_Add_Destination object is configured to specify the collector's address.
Question
An administrator is setting up Cisco Firepower to send data to the Cisco Stealthwatch appliances. The NetFlow_Set_Parameters object is already created, but NetFlow is not being sent to the flow collector. What must be done to prevent this from occurring?
Options
- AAdd the NetFlow_Send_Destination object to the configuration
- BCreate a Security Intelligence object to send the data to Cisco Stealthwatch
- CCreate a service identifier to enable the NetFlow service
- DAdd the NetFlow_Add_Destination object to the configuration
How the community answered
(29 responses)- A10% (3)
- B14% (4)
- C3% (1)
- D72% (21)
Why each option
Even if NetFlow parameters are configured on a Cisco Firepower device, NetFlow data will not be sent to a collector like Cisco Stealthwatch until a NetFlow_Add_Destination object is configured to specify the collector's address.
While conceptually similar, 'NetFlow_Add_Destination' is the more accurate and commonly used object name in Cisco FTD for this purpose.
Security Intelligence objects are used for blocking or allowing traffic based on reputation lists, not for configuring NetFlow export.
A 'service identifier' is not a standard configuration object for enabling or configuring NetFlow export in Cisco FTD.
In Cisco FTD, configuring a NetFlow_Set_Parameters object defines how flows are captured. However, to actually export these flow records, you must separately specify the destination (the flow collector's IP address and port) using a NetFlow_Add_Destination command or GUI equivalent.
Concept tested: Cisco Firepower NetFlow export configuration
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-70/configure_netflow_for_firepower_threat_defense.html
Topics
Community Discussion
No community discussion yet for this question.