Tech Note #015. General requirements

Transcription

1 Mazu Networks, Inc. 125 CambridgePark Dr. Cambridge, MA Phone (617) Fax (617) Configuring NetFlow for Profiler Tech Note #015 Product: Profiler Version: 5.5 Date: 8/18/05 This note presents examples for configuring Cisco 6500 and 7500 series routers to provide NetFlow data to Profiler. This information is intended only as a guideline, and future changes to Cisco software may obsolete these examples. Please contact Cisco Systems or your Cisco reseller for specific information or assistance. General requirements The general requirements for setting up routers to send NetFlow data to Profiler are as follows: Routers should be configured for NetFlow V1, V5 or V7 with no aggregation. Routers should export NetFlow to the Profiler or Regional Gateway Management interface and use the destination port that is configured on the Mazu equipment. The default is udp/2003. Routers using Cisco IOS should be synched to an NTP server. The timestamps on the network equipment and Mazu equipment should be relatively close. Router(config)#ntp server Router#show ntp associations address ref clock st when poll reach delay offset Disp ~ *~ * master (synced), # master (unsynced), + selected, - candidate, ~ configured Router#show clock 14:29: EDT Fri Aug The active timeout setting for flows should be set to 60 seconds. The inactive timeout setting can be left at the default setting of 15 seconds. It must be less than 60 seconds. When NetFlow is to be used on a Cisco 6500 switch equipped with both MSFC and SUP1 modules, it must be enabled on both the router level and the switch level. The route once, switch many concept applies to this hardware configuration. A new flow is first routed by the MSFC module before being placed in the MLS cache and being switched. Therefore, it is important for Profiler to receive NetFlow data from both modules to avoid missing any data. A similar concept applies to a chassis with SUP2 or 720 modules. 1

2 Configuring 7500 series router The following example uses the IOS command line interface to configure a 7500 series router. The commands are similar for most of the software routing platforms. 1. Configure NDE (Netflow Data Export): ip flow-export <ip_address> < udp_port> <version> where ip_address and udp_port are the Profiler IP address and UDP port, respectively, and version is the NetFlow version. Router(config)# ip flow-export Enable NetFlow at the interface level on each interface where you want to collect statistics: interface <type> <slot>/<port-adapter> 3. Set the Netflow timers. Router(config)# ip flow-cache timeout active 1 # This breaks up long-lived flows into one-minute segments. Router(config)# ip flow-cache timeout inactive 15 # This ensures that flows that have finished are exported in a timely manner # (15 seconds). Configuring 6500 series switches running native IOS The following example uses the native IOS command line interface to configure the SUP and MSFC modules of a 6500 series switch. This example is based on the Cisco documentation for Cat6500 w/ SUP2/720 running IOS For further information, refer to _guide_chapter09186a a2b.html. At the switch level (SUP2) mls netflow mls nde sender version 5 mls flow ip interface-full mls nde interface mls aging normal 32 mls aging long 64 # Enables Netflow on the PFC # Turns on Netflow, sets version # (verify options; this may have to be version 7) # Sets an appropriate flow mask # Populates egress interface fields - not needed # Netflow inactive timeout in seconds # Netflow active timeout in seconds 2

3 At the routing module (MSFC) ip flow-export source loopback 0 # Define Netflow source address (not needed). # Otherwise, Netflow egress interface is used. ip flow-export version 5 # Define Netflow version ip flow-export destination # Profiler IP address and UDP port ip flow-cache timeout inactive 15 # Inactive timeout in seconds # May be version specific ip flow-cache timeout active 1 # Active timeout in minutes # May be version specific Then for each interface or interface grouping where NetFlow accounting is required (three types of interfaces), perform the following setup, as applicable: interface <type> <slot>/<port> OR interface vlan <vlan_id> Router(config)# interface vlan 3 OR interface port-channel <channel_id> Router(config)# interface port-channel 3 Configuring 6500 series switches in Hybrid mode The following example configures the SUP and MSFC modules of a 6500 series switch running in the Hybrid mode. At the switch level (SUP) 1. Enable NDE (Netflow Data Export): set mls nde enable 2. Set the NDE destination: set mls nde enable <collector_ip> <udp_port_number> where collector_ip is the IP address of the Profiler. 3

4 set mls nde enable Set Netflow timers: set mls agingtime 16 # Inactive timeout set mls agingtime fast 32 0 # Inactive timeout for aggressive aging set mls agingtime long-duration 64 # Active timeout 4. Set the flow mask to full to avoid losing resolution by mapping multiple flows to the cache entry: set mls flow full At the routing module (MSFC) 1. Configure NDE (Netflow Data Export): ip flow-export <ip_address> < udp_port> <version> where ip_address and udp_port are the Profiler IP address and UDP port, respectively, and version is the NetFlow version. Router(config)# ip flow-export Enable NetFlow at the interface level on each interface where you want to collect statistics: interface <type> <slot>/<port-adapter> 3. Set the Netflow timers. Router(config)# ip flow-cache timeout active 1 # This breaks up long-lived flows into one-minute segments. Router(config)# ip flow-cache timeout inactive 15 # This ensures that flows that have finished are exported in a timely manner (15 seconds). Determining the source of NetFlow data To identify the source of a NetFlow data stream from within Profiler: 1. Log in on the Profiler CLI and stop mazuctl /etc/init.d/mazuctl stop 2. Run tcpdump tcpdump t n T cnfp udp port 2003 (this assumes the Mazu default Netflow port of udp/2003) 3. In the tcpdump output, examine the source addresses of the NDE messages or the format of the Netflow data exported. 4. Restart mazuctl /etc/init.d/mazuctl start 4

5 Determining the flow rate from all NetFlow sources To determine the flow-rate from all Netflow sources, examine the following files (in v5.0 or v5.5): /click/flow_collector_1/collector/flowcount # Number of flows seen so far during this updateperiod, changing counter that is reset every updateperiod. /click/flow_collector_1/collector/counts # Total number of flow seen during the previous timeperiod For Additional Information For questions on specific Netflow configuration options or commands, please contact Cisco Systems or your Cisco reseller. For questions on Mazu Profiler, contact Mazu Technical Support at: (menu option #2) or [email protected] 5