Deploying Riverbed Cascade and Steelheads. A Best Practices Whitepaper

Transcription

1 Deploying Riverbed Cascade and Steelheads A Best Practices Whitepaper

2 Contents 1. Introduction Steelhead Releases Steelhead Appliance Deployment Scenarios Configuring Steelhead Appliances for Flow Data Export... 3 Overview... 3 RiOS v5.5.1 and v RiOS v Additional Steelhead Configuration Steps... 8 Overview... 8 Simplified Routing... 8 LAN Subnets... 9 ifindex Persistence Configuring Cascade Profiler Overview SNMP Configuration WAN Configuration Interface Groups WAN Optimization Reports Standard Reporting Templates WAN Optimization Site Reporting WAN Optimization Intersite Reporting WAN Optimization Overall Reporting Additional Profiler Capabilities Application Performance (w/ RTT) User-defined Policy for Response Time Application Fingerprinting User Identity Logical Path Association Integrations and Extensible API Summary Riverbed Technology. All rights reserved.

3 1. Introduction Businesses large and small rely upon the network to ensure availability of critical business services. There are seemingly conflicting requirements to deploy new, more complex applications while decreasing transaction time to make employees and customers more efficient while driving costs out of the infrastructure. The Riverbed Steelhead appliance provides significant advantages to companies wanting to optimize their infrastructure and provide reliable and faster connectivity between sites. There is an associated cost, however, as visibility into the WAN is reduced. As a result, troubleshooting and performance analysis can be more difficult. Riverbed Cascade Profiler ensures this visibility is not lost and provides real-time and historical views of the infrastructure and associated host conversations, both locally and across the optimized and non-optimized WAN infrastructure. All the benefits that Cascade Profiler delivers including real-time and historical reporting, automatic and custom behavioral analytics, and configurable dashboards are available to support the optimized network infrastructure. As a result, organizations can: Better understand their network for planning purposes Be alerted to meaningful changes in network, application, user, and host behavior Quickly triage issues by understanding the impact to the business Compare current behavior to typical or historical behavior, expediting root cause analysis Maintain information for audit purposes This document describes how to deploy Riverbed Steelhead appliances in conjunction with Cascade Profiler. It is written for network administrators who are familiar with the NetFlow functionality of the two products. This document provides a high level overview of the operation of the Riverhead Steelhead and Cascade Profiler appliances and is not intended as a step-by-step guide or a replacement for the respective products documentation. Readers should refer to individual product documentation for more details Riverbed Technology. All rights reserved. 1

4 2. Steelhead Releases This document describes features that are in RiOS v5.5.1, RiOS and RiOS 6.0. It also covers Cascade Profiler releases 8.3 and 8.4. The table below provides a summary of the features available in each release. Feature RiOS v5.5.1 RiOS v5.5.3 RiOS 6.0 NetFlow Support v5 v5 v5 and v9 Enhanced NetFlow Support N/A v5.1 CascadeFlow (v9 based) and CascadeFlow-compatible (v5 based) WAN optimization reporting Cascade Profiler v8.3 and v8.4 Cascade Profiler v8.3 and v8.4 Cascade Profiler v8.3 and v8.4 Automatic identification of optimizing Steelhead pairs N/A Available with NetFlow v5.1 Available with CascadeFlow or CascadeFlow-compatible Sensor-VE Requires Cascade Profiler v8.4 Requires Cascade Profiler v8.4 Requires Cascade Profiler v Steelhead Appliance Deployment Scenarios There are multiple deployment models to consider when architecting a monitoring solution for the Riverbed environment, including in-path, virtual in-path, and out-of-path configurations. There are also variants of these deployment models. This document focuses on the in-path and virtual in-path deployment models. Refer to the Riverbed Steelhead Deployment Guide for additional details on deployment models. In-path In this configuration, the Steelhead appliances are placed in the physical path of the client and server, where they see all traffic. You enable flow data export and use the primary/auxiliary interface to export the data to the Cascade Profiler. Select All to export all traffic received by the Steelhead appliance to Cascade Profiler, ensuring all optimized and non-optimized traffic is exported. In this mode, the traffic on the LAN interface is non-optimized while traffic on the WAN interface is optimized. Virtual in-path In a virtual in-path deployment, the Steelhead appliances are placed physically out of the path but virtually in the path between the clients and servers. Clients and servers continue to see the real client and server IP addresses. This deployment differs from a physical in-path deployment in that a packet redirection mechanism is used to direct packets to the Steelhead appliance. Redirection mechanisms include PBR (Policy Based Routing) and WCCP (Web Cache Communication Protocol). In this configuration, you enable NetFlow on the WAN interface and export flow data for only the optimized traffic from the Steelhead. You use the router to export the pass-through flow data. In a virtual in-path configuration, the Steelhead appliances do not have sufficient information to determine the flow direction of pass-through traffic. Therefore, it is necessary to enable NetFlow export on the router to capture information about the passthrough traffic. Enabling NetFlow on the router will allow for reporting traffic on the actual WAN link. If the Steelhead is using correct addressing, the optimized connections will be reported using the Steelheads as the end-points of the flow, not the original client/server. There is the potential for some double counting in reports under certain circumstances. Note, however, that the router s WAN interface must not be included in the WAN Optimized group, as it is not an endpoint in optimization. Additionally, the following command must be run on the Steelhead appliance that is running virtually in-path: enable config term ip flow-export destination <ip address> <port> interface wan0_0 fakeindex on This enables the Steelhead appliance to determine the flow of optimized traffic on the WAN interface in a virtual in-path set up Riverbed Technology. All rights reserved. 2

5 If reports are showing abnormally large bandwidth on the Steelhead WAN interface, it is an indication that either fakeindex was not enabled or LAN subnets were not properly configured. (See additional detail below.) A flow list on such traffic would show flows with both the ingress and egress interfaces of the Steelhead as the WAN, such as wan0_0. To get information on only the non-optimized traffic, create a report using a host subnet (or host address) with the Steelhead client IP address. In this configuration, the Steelhead does not see all traffic passing from the LAN to the WAN. It sees only traffic that the router is configured to redirect to the Steelhead. This typically is selective of only flows that have a good chance for optimization, such as CIFS. As a result, it is not generally possible to report on the actual WAN-link utilization based on the Steelhead reports. Out-of-path An out-of-path deployment is a network configuration in which the Steelhead appliance is not in the direct physical path between the client and the server. In an out-of-path deployment, the Steelhead appliance acts as a proxy. An out-of-path configuration is suitable for data center locations where physical in-path or virtual in-path configurations are not possible. The out-of-path solution uses NAT (Network Address Translation) thus there is no direct correlation between the client/server conversation and the traffic over the WAN. It is still possible to create valuable reports with this configuration. However, the operator will be unable to view the benefit of optimization. In this configuration, you enable NetFlow on the primary/auxiliary interface and export flow data for only the optimized traffic from the Steelhead appliance. Similar to the virtual in-path deployment, you configure the router to export the pass-through flow data, as the Steelhead appliance will see only optimized data in this configuration. Steelhead appliances are unable to determine the flow of the optimized data in this configuration and are therefore unable to split traffic based on the source (e.g., LAN or WAN). Similar to the virtual in-path deployment, fakeindex must be enabled in order to properly report on the direction of the optimized traffic through the Steelhead appliance. Configuration of the LAN subnets is not necessary, because the out-of-path Steelhead sees only optimized traffic and is never passing through any traffic. 4. Configuring Steelhead Appliances for Flow Data Export Overview This paper specifically addresses the configuration of flow data export in Riverbed RiOS releases after v Exported flow records contain network statistics providing information about network hosts, protocols and ports, peak usage times, and traffic logical path. The Steelhead updates each flow record with information pertaining to each packet traversing the specified network interface. This data is then sent to a flow data collector such as the Cascade Express or Cascade Gateway. The Cascade flow collection default port is 2003, which can be changed as described later in this document. The following sections describe flow data export for RiOS versions v5.5.1/v5.5.3 and RiOS version 6.0. Choose the section that is relevant for the RiOS version installed on your Steelhead devices. RiOS v5.5.1 and v5.5.3 To enable NetFlow on the Riverbed Steelhead appliance running RiOS v5.5.1 or RiOS v5.5.3, navigate to the Configure Networking NetFlow page and set the configuration as follows. Navigate to the NetFlow configuration page. 1. Click the Configure tab to display the Configuration menu. 2. Click Networking to expand the Networking menu. 3. Click NetFlow to display the NetFlow page Riverbed Technology. All rights reserved. 3

6 Enable NetFlow 1. Select Enable NetFlow Export. 2. Select Disable Top Talkers. 3. Configure the Active Flow Timeout for 60 seconds. 4. Configure Inactive Flow Timeout for 15 seconds. 5. Click Apply. The changes take effect when you click Apply, but they are not saved until you click Save on the main menu bar Riverbed Technology. All rights reserved. 4

7 Configure the NetFlow Collector and Exporting Interfaces 1. In the NetFlow Collectors section of the Configure Networking NetFlow page, click the Add a New NetFlow Collector tab. 2. Enter the IP address and listening UDP port number of the Cascade Express or Gateway. 3. Select the version of NetFlow to be exported. Select version 5.1 or later if available. 4. Ensure the LAN Address box is selected as this ensures the proper client and server IP addresses are exported via NetFlow and not the addresses of the Steelhead appliance. 5. For the desired interfaces, select All to export both optimized and non-optimized flow information. 6. Choose Add to add the Cascade Profiler or Gateway to the collector list. The changes take effect when you click Add, but they are not saved until you click Save on the main menu bar. Notes: If the Steelhead is running RiOS version or later, then there will be an option for exporting NetFlow 5.1. This option allows the Profiler to recognize Steelhead devices and automatically add them to the Steelhead WAN interface group. The Apply button and Add button make your changes temporarily. You must click Save on the main menu bar for the changes to be saved when the appliance is rebooted. RiOS v6.0 To enable flow data export on the Riverbed Steelhead appliance running RiOS v6.0, navigate to the Configure Networking Flow Export page and set the configuration as follows. Navigate to the Flow Export configuration page. 1. Click the Configure tab to display the Configuration menu. 2. Click Networking to expand the Networking menu. 3. Click Flow Export to display the Networking Flow Export page Riverbed Technology. All rights reserved. 5

8 Enable Flow Data Export 1. As shown below, select Enable Flow Export. 2. Select Disable Top Talkers. 3. Configure the Active Flow Timeout for 60 seconds. 4. Configure Inactive Flow Timeout for 15 seconds. 5. Click Apply. The changes take effect when you click Apply, but they are not saved until you click Save on the main menu bar Riverbed Technology. All rights reserved. 6

9 Configure the Flow Collector and Exporting Interfaces 1. In the Flow Collectors section of the Configure Networking Flow Export page, click the Add a New Flow Collector tab. 2. Enter the IP address and listening UDP port number of the Cascade Express or Gateway. 3. Select the version of flow data to be exported. CascadeFlow is the preferred flow data type for Cascade Profiler 8.4. For Cascade Profiler 8.3.2, select CascadeFlow-compatible and be sure to check the LAN Address check box. 4. For the desired interfaces, select All to export both optimized and non-optimized flow information. 5. Choose Add to add the Cascade Express or Gateway to the collector list. The changes take effect when you click Add, but they are not saved until you click Save on the main menu bar. Notes: Selecting CascadeFlow or CascadeFlow-compatible as opposed to NetFlow v5 or v9 allows the Profiler to recognize Steelhead devices and automatically add them to the Steelhead WAN interface group. The Apply button and Add button make your changes temporarily. You must click Save on the main menu bar for the changes to be saved when the appliance is rebooted Riverbed Technology. All rights reserved. 7

10 5. Additional Steelhead Configuration Steps Overview The following configuration steps on the Steelhead are recommended to improve the accuracy of the exported flow data. The recommendations are deployment-specific and there are caveats associated with each, so make sure that these are suitable for the Steelhead deployment in question. Simplified Routing Simplified Routing avoids situations where traffic could be directed through the Steelhead appliance more than once, causing what is commonly known as ricochet. When this happens, the same traffic is reported by the Steelhead multiple times, which causes an unexpected increase in bandwidth, packets, and other traffic statistics in various Profiler reports. This can happen when the Steelhead appliance is installed in a different subnet from the client or server and the appropriate static routes have not been configured to avoid traffic passing through the Steelhead multiple times on the way to and from the default gateway. Simplified Routing works well in In-path configurations. It has the following constraints in other configurations: WCCP cannot be enabled. HSRP cannot be used with Simplified Routing. The default route must exist on each Steelhead appliance in your network. Simplified Routing is configured on the Configure Networking Simplified Routing page as follows. Navigate to the Simplified Routing configuration page. 1. Click the Configure tab to display the Configuration menu. 2. Click Networking to expand the Networking menu. 3. Click Simplified Routing to display the Simplified Routing page. Configure Mapping Data Collection On the Simplified Routing page, select the desired setting from the Collect Mappings From dropdown menu: Select Destination Only if this is a connection-forwarding deployment. This is the default option and is suitable for most deployments. However, in complex deployment scenarios one of the other options may be more suitable. Refer to the Steelhead reference manual and/or your Riverbed SE to determine if one of the other simplified routing options is more appropriate. Select Destination and Source if this is a connection-forwarding deployment, yet the goal is to maximize the effect of simplified routing. Select All to maximize the effect of simplified routing. All collects MAC data for the destination, source and inner connection. This option cannot be used in connection forwarding deployments Riverbed Technology. All rights reserved. 8

11 LAN Subnets In Virtual In-path configurations, configuring LAN subnets allows the Steelhead to properly determine the direction of nonoptimized traffic that is passing through the Steelhead. Otherwise, the Steelhead will be unable to discern whether the traffic is passing from the WAN to the LAN or in the opposite direction. This can result in over-reporting traffic in a particular direction or for a particular interface. This configuration step must be performed on each Steelhead in a virtual in-path configuration, as the subnets for each will likely be unique. This configuration is necessary only in Virtual In-path configurations. RiOS v5.5.1 and v5.5.3 To configure LAN Subnets on a Riverbed Steelhead appliance running RiOS v5.5.1 or RiOS v5.5.3, navigate to the Configure Networking NetFlow page as described above. 1. On the NetFlow page, enter all of the LAN subnets that are appropriate for the particular Steelhead device. Any subnet not specified is assumed to be a WAN subnet, so take care to include all relevant LAN subnets. 2. When done, click Apply. RiOS v6.0 To configure subnets on a Riverbed Steelhead appliance running RiOS v6.0, navigate to the Configure Networking Flow Export page as described above. 1. On the Flow Export page, click the Subnet Side Rules tab at the top of the page. 2. On the Subnet Side Rules page, click Add a Subnet Side Rule. 3. Select Start, End or rule number from the drop down list. The rules are evaluated in order, and evaluation stops when a rule matches, so be sure to properly order the rules. 4. Specify a subnet using valid CIDR notation. 5. Using the radio buttons, indicate whether this subnet is a LAN or WAN side subnet. 6. Click Add to save the rule. 7. Continue to add rules until you have completely mapped all subnets Riverbed Technology. All rights reserved. 9

12 ifindex Persistence In order to guarantee that the ifindex values for various interfaces remain stable across Steelhead reboots and reconfiguration, ifindex persistence should be configured on each Steelhead that is exporting flow data to the Profiler. If this is not done, there is the possibility that ifindex values will change, causing the Profiler to incorrectly map the Steelhead interfaces. Enabling ifindex Persistence Enabling ifindex persistence must be done via the Steelhead CLI. Refer to the sample command line output below for an example of making and verifying the changes: ssh SH> [In this example, the Steelhead is cam-sh12.] cam sh12 > en cam sh12 # config t cam sh12 (config) # snmp ifindex persist You must restart the optimization service, so that netflow can use the configured ifindex cam sh12 (config) # exit cam sh12 # write mem cam sh12 # show snmp SNMP enabled: yes System location: System contact: Engine ID: 0x b805dc6257f4b328d15 Read only community: riverbed Traps enabled: yes Interface listen enabled: no Trap interface: primary Persistent ifindex: yes No Listen Interfaces. No trap sinks configured Riverbed Technology. All rights reserved. 10

13 6. Configuring Cascade Profiler Overview The Profiler is able to provide robust reporting of the optimized and non-optimized infrastructure. Information such as the effect of optimization, application name, and application performance using round trip time measurements is available for both real-time and historical reporting. These capabilities are shown in the screenshots that follow and are explained in more detail in Section 8. SNMP Configuration Configuring the Profiler for the WAN optimized environment requires setting up the SNMP configuration and editing the WAN definitions and interface groups, as follows. Configure SNMP with the Steelhead appliances The Profiler retrieves interface information directly from the Steelhead appliances, ensuring common terminology is used between the Steelhead appliance and the Profiler. SNMP interface polling can be configured globally and/or for a specific device. Both configurations are shown below. Even though SNMP is configured on the Profiler, the Gateway actually conducts the SNMP polling of the interfaces locally and forwards the interface information to the Profiler using an encrypted and reliable mechanism. 1. Navigate to the System Information Devices/Interfaces page. 2. Select the Global SNMP Settings link. A dialog box is displayed. 3. Select the check box to Enable polling 4. Select Use defaults for all devices to enable a default community string to use when polling devices for interface information. Unless a community string is explicitly configured for a device, the default is used. 5. Enter the default SNMP Community string for SNMP read access Riverbed Technology. All rights reserved. 11

14 Configuring SNMP for individual devices To configure an individual device to use a SNMP read community string different from the default, 1. Click the Edit link to the right of the device. A dialog box appears. 2. Select the Use custom settings option. 3. Enter the SNMP Community string for the Steelhead appliance. Note: These steps are required only if the Steelhead appliance uses a different SNMP read community string than the default setting for the organization. Configure the WAN interface Speed of the Steelhead interface exporting flow data The Profiler uses SNMP to collect information about the flow data exporter (i.e., the Steelhead appliance). SNMP provides, among other details, the speed of the interface exporting the flow data. Thus the interface speed information received by the Profiler refers to the connectivity between the Steelhead appliance and the router, and not to the outbound WAN link (e.g., Frame Relay sub interfaces). This means that the Profiler would typically report the outbound interface to be a 100 Mbps or a 1 Gbps link instead of a T1, T3 or DS3 link. To enable the use of link utilization in Profiler reporting and custom analytics, it is recommended that you change the speed of the WAN interface on the Steelhead to match that of the outbound WAN link (for example, T1): 1. Log in to the Profiler web interface. 2. Navigate to the System Information Devices/Interfaces page. All the devices and interfaces exporting flow data are identified on this page. Note that the WAN device will not appear in this list if it is not configured for flow data export. 3. Select the Interfaces (List) tab Riverbed Technology. All rights reserved. 12

15 4. For each Steelhead WAN interface, enter the speed of the actual outbound WAN in the Outbound Speed Override column. For example, if the outbound link is a T1, enter Make the necessary changes and then click the Apply button on the bottom right side of the page. WAN Configuration For correct WAN optimization reporting, the WAN interfaces of the WAN optimization devices must be properly identified by the Profiler. The Profiler has a specific page under the Definitions menu called WAN dedicated to keeping track of both optimized and non-optimized WAN interfaces. When using NetFlow 5.1 on RiOS v5.5.3 or RiOS v6.0 with either CascadeFlow or CascadeFlow-compatible, the Steelhead provides information to the Profiler that enables the WAN page to be automatically populated with the appropriate interface details. When using NetFlow v5 or V9 from a Steelhead or when adding interfaces for a WAN site that is non-optimized, manual configuration is required as follows: 1. Navigate to the Definitions WAN page Riverbed Technology. All rights reserved. 13

16 2. On the WAN Interfaces table, select Add from the WAN Options drop down menu. This displays a new section above the WAN Interfaces table named Add WAN Interfaces. This section has an edit entry area (Add new Interfaces) for specifying multiple WAN interfaces. 3. Add the WAN interfaces from the Riverbed Steelhead devices that you would like to monitor. For Steelheads that are configured to use either NetFlow v5.1 (a.k.a. CascadeFlow-compatible) or CascadeFlow, there should already be interfaces listed and it will not be necessary to add these manually. For other interfaces, there are several methods for manually extending the list: Manually Type the interface names separated by commas. Note that any name entered must be in a format that can be recognized by Profiler. In other words, it must have been seen in flow data that was reported to the Profiler and must follow Profiler conventions for interface naming. Browse There is a link for Browse under the Add new Interfaces entry box. By default, the Browse dialog displays all of the interfaces that are known to the Profiler. There is a search capability at the top of the dialog for narrowing the content being displayed. Select an interface by clicking the checkbox next to the desired interface name. Multiple interfaces can be selected at one time. Click OK to add the selected names to the Add new Interfaces list. Find Steelheads There is a link labeled Find Steelheads that automatically searches the list of interfaces for any interface that follows standard Steelhead naming conventions. This feature is provided as a convenience and provides one click access to all interfaces with appropriate names. 4. Choose Add as Steelhead Interfaces if the interfaces in the list are all optimized interfaces. Do not choose this option if the interfaces in the list are non-optimized interfaces or if the selection contains a mix of optimized and non-optimized interfaces. Incorrectly designating a non-optimized interface as optimized or vice versa will cause issues with properly reporting bandwidth reduction on the Profiler. 5. Click OK to add the interfaces to the WAN Interfaces list. Interface Groups Interface grouping is a powerful capability unique to Cascade that allows the operator to organize network interfaces for selection and reporting purposes. For example, users can choose to group devices or interfaces to map them to a business function or organize them based on a country or on a continent for easy reporting. Devices and interfaces can also be used for user-defined policies, thus another use is to group devices or interfaces with common business policies, making policy definitions easier to instantiate and maintain Riverbed Technology. All rights reserved. 14

17 By default, three interface groups are automatically created based on how the user fills out the WAN page described above. The default groups are: WAN-All Contains all the interfaces added to the WAN page regardless of whether they are optimized. This interface list always contains all the interfaces contained in the WAN-Steelhead group plus the WAN-Non-optimized group. WAN-Steelhead Contains a list of all the optimized interfaces. WAN-Non-optimized Contains a list of all the WAN interfaces that were not designated as optimized. These default groups are automatically maintained by the Profiler and can be modified only by changing the interfaces listed on the WAN page. To define a new group of devices or interfaces, 1. Navigate to the Definitions Interface Groups page. 2. Enter the name of the new group. 3. Click Add. The page expands to display an area in which you can list the interfaces that comprise this group. 4. Enter the names of the interfaces in the group, either manually or by using Browse. Because both reporting and userdefined policies make use of interface grouping, it is best to select logical groupings of the devices and interfaces that will typically be included in a report or policy. 5. Click OK. Refer to the online help system for additional information Riverbed Technology. All rights reserved. 15

18 7. WAN Optimization Reports Riverbed has taken great care to make the configuration of both the Steelhead appliances and the Cascade Profiler as quick and simple as possible, enabling businesses to benefit from the improved performance and reporting afforded by a combined solution. The Profiler has a combination of standard templates and custom reporting options available to demonstrate the benefit of WAN optimization. In addition, the Profiler can identify candidates for future WAN Optimization deployments. Many solutions make WAN Optimization and WAN reporting in general very difficult, forcing the operator to define WAN and LAN interfaces. The Profiler correlates LAN and WAN measurements from multiple devices automatically and computes the benefit of WAN optimization so that the operator does not have to. The figure that follows illustrates the points at which the Profiler makes traffic measurements. Standard Reporting Templates The Profiler provides standard reporting templates. New templates specific to the organization can be generated and saved. The standard WAN optimization reporting templates include: Overall WAN Analysis Optimization Benefit Analysis Optimization Candidate Analysis Site Capacity Analysis WAN Site Optimization WAN Intersite Optimization Additionally, you can define a wide variety of site, intersite, and overall WAN reports on the Profiler reporting pages. To run a report based on one of the standard, predefined templates, 1. Navigate to the Reports Shortcuts page. 2. On the Built-in tab of the Shortcuts page, click the link for one of the WAN Optimization templates. 3. In the Report Criteria window, enter the requested information, either manually or by using the Browse tool. 4. Click Run now to run the report. The resulting report can be ed, printed, and scheduled for recurring runs Riverbed Technology. All rights reserved. 16

19 WAN Optimization Site Reporting The Profiler makes it easy to understand the positive impact of WAN Optimization on the business. WAN Optimization solves more than bandwidth issues. It also solves application performance issues, ensuring access to business applications is optimized and allowing the business to run more effectively. The Profiler WAN optimization site reporting features allow the operator to quickly determine the performance of a site through numerous different views, including by application, port, host, and other views. To run a report on WAN optimization achieved by a WAN site, 1. Navigate to the Reports WAN Optimization page and choose the Site tab Riverbed Technology. All rights reserved. 17

20 2. Enter the name of the WAN group that you have defined for the site of interest. Alternatively, use the Browse tool to select the interfaces of the site in which you are interested. 3. In the Report by field, select attributes to be reported. 4. Click Run now to run the report. In this example, the amount by which the site optimizes traffic is to be reported by ports and applications. The default report time period is one hour. However, you will notice we changed this query to 2 hours. You can also view historical information by selecting a specific time range. WAN Optimization Intersite Reporting The Profiler WAN optimization intersite reporting features allow the operator to configure a report on traffic between two sites. This report is helpful for the data center fan-in model, where numerous remote sites are terminating on a single Steelhead appliance in the data center as shown in the figure that follows. To run a report on WAN optimization between two WAN sites, 1. Navigate to the Reports WAN Optimization page and choose the Intersite tab. 2. Specify the Primary Site. Traffic will be reported as inbound or outbound relative to this site. 3. Specify the Secondary Site and the Report by attributes. 4. Click Run now to run the report Riverbed Technology. All rights reserved. 18

21 WAN Optimization Overall Reporting The Profiler WAN optimization overall reporting features allows the operator to view all of their WAN links and determine how they are performing. The interface grouping, which was described previously, is very beneficial with overall reporting. The example that follows uses the default WAN group. This report identifies the site and utilization percent of both the WAN and LAN, and the average reduction in bandwidth for the specified time frame Riverbed Technology. All rights reserved. 19

22 Selecting the down-arrow on the table displays a menu of options. Choose Add/Remove Columns to open the column chooser tool Riverbed Technology. All rights reserved. 20

23 The Chooser allows you to design a table that includes columns for just those attributes that you want to report. 8. Additional Profiler Capabilities Application Performance (w/ RTT) The Profiler provides application performance metrics, allowing the operator to determine how an application is performing. Additionally, a comparison can be made using the current and historical views, enabling the operator to quickly identify discrepancies. The reporting metrics are broken down to average server delay, average network round trip time, and overall round trip time. The Riverbed WAN optimization technology not only reduces WAN bandwidth, but it also improves the user experience by optimizing the response time of the application. This increase in application performance has a direct benefit to the business in improved employee productivity. The following report identifies the server delay, network response time, and average response time for applications traversing an optimized link to a remote site Riverbed Technology. All rights reserved. 21

24 User-defined Policy for Response Time User-defined policies in the Cascade Profiler provide the organization with proactive solutions to identify problem before they impact the business. The powerful user-defined policy capabilities are a unique capability of the Cascade Profiler and have been extended to include alerting on meaningful changes in response time for an application, remote site, host or group of hosts. The figure below identifies a policy that will proactively alert the Network Planning group should the response time of the Financial Server increase to over 50 ms for more than a 5 minute period Riverbed Technology. All rights reserved. 22

25 Application Fingerprinting New applications using non-standard ephemeral ports and tunneling over known ports make it difficult for network operators to accurately identify which applications are running. Other management tools identify applications using a protocol and port association. The Profiler application fingerprinting feature identifies the applications by inspecting the packet payload and comparing the payload to an extensive list of known applications. This allows operators to quickly understand the application traversing a given flow, for example, Skype using tcp/80 or users going to Gmail. The application fingerprinting capability is enabled by the Cascade Sensor, which resides passively on the network, inspecting traffic via SPAN or mirror ports. Unlike traditional packet inspection devices, the Cascade Sensor tags a given flow with the application detail, thus requiring fewer appliances to provide coverage across the enterprise. User Identity The Profiler integrates with identity management solutions. This enables the operator to quickly identify a user who is consuming the network bandwidth or disrupting other users. The user identity feature is available for real-time and historical reporting as well as through the custom analytics engine. Logical Path Association Using SNMP integration, the Profiler records the logical path that a flow takes across the network. This makes it possible to determine whether the primary or redundant path was traversed by a particular flow. Integrations and Extensible API The Profiler provides out-of-the-box integrations with more than 40 popular enterprise technologies to increase the value of your existing infrastructure investments. These integrations help you quickly identify and triage new events regardless of how they are generated (Profiler or other tools). Additionally, they reduce training requirements as the information provided by the Profiler is available from within tools already familiar to the network operators. The extensible API also provides the ability for custom integrations with homegrown tools Riverbed Technology. All rights reserved. 23

26 9. Summary The emergence of WAN optimization devices such as Riverbed Steelhead appliances has brought new challenges and contradicts some fundamental assumptions made in NetFlow. Our testing has proven that the Riverbed Steelhead and Cascade products work together to not only maintain current levels of visibility but also to provide customers with additional valuable insight into their optimized network. Riverbed Technology, Inc. 199 Fremont Street San Francisco, CA Tel: (415) Riverbed Technology Ltd. 1, The Courtyard, Eastern Rd. Bracknell, Berkshire RG12 2XB United Kingdom Tel: Riverbed Technology Pte. Ltd. 391A Orchard Road #22-06/10 Ngee Ann City Tower A Singapore Tel: Riverbed Technology K.K. Shiba-Koen Plaza Building 9F 3-6-9, Shiba, Minato-ku Tokyo, Japan Tel: Riverbed Technology. All rights reserved. 24