Network Element Configuration

Transcription

1 The following describes how to configure Flexible NetFlow and NTP servers on your ISR. Configuring a Network Element, page 1 NTP Configuration, page 1 NetFlow Configuration, page 2 Configuring a Network Element Configure NTP server addresses on the ISR to synchronize time between the controller, agent, and ISR. Configure Flexible NetFlow on the ISR to pass NetFlow data from the router to the agent. Configure NTP on your ISR. See NTP Configuration, on page 1 for more information. Configure NetFlow, so the router can pass NetFlow data to the agent. See NetFlow Configuration, on page 2 for more information. NTP Configuration To configure NTP server addresses on the ISR, associate the router management interface with the NTP servers. Alternatively, if you have a loopback interface already configured, you can use that instead to reference NTP servers. Configuring NTP on the ISR You can enter each command individually. You can also paste the commands from the example below into a text editor, update the variable, then paste all the updated commands into the command line. enable ntp source GigabitEthernet0/0/0 1

2 NetFlow Configuration ntp server <ipv4-addresses> exit If you have an existing loopback interface, use that as the NTP source interface. Otherwise, use the router management interface. DETAILED STEPS Step 3 Step 4 Step 5 enable Router> enable ntp source GigabitEthernet0/0/0 Router# ntp source GigabitEthernet0/0/0 ntp server ipv4-addresses Router# ntp server show ntp association Router# show ntp association exit Enable privileged EXEC mode. Enter your password if prompted. Use the GigabitEthernet0/0/0 interface to connect to an NTP server. Use the GigabitEthernet0/0/0 interface to connect to an NTP server. Define multiple addresses to specify backup NTP servers. Display configured NTP servers. If the system does not display correctly configured NTP servers, repeat the configuration process. Exit privileged EXEC mode. Router# exit NetFlow Configuration To capture information about traffic traversing your network, you must configure the following Flexible NetFlow components in order: SLN-NF-RECORD - a NetFlow flow record which defines key fields to match traffic, and non-key fields to collect SLN-NF-EXPORTER - a NetFlow flow exporter that references the agent Control IP address to s NetFlow data to the agent SLN-NF-MONITOR - a NetFlow flow monitor that references SLN-NF-RECORD to monitor input and output traffic coming over configured branch interfaces, and forwards it to SLN-NF-EXPORTER 2

3 Configuring a NetFlow Record The following diagram illustrates NetFlow operation on the ISR. Figure 1: NetFlow Operation on the ISR As input and output traffic passes over the branch facing interfaces, the SLN-NF-MONITOR flow monitor, referencing the SLN-NF-RECORD flow record, monitors the traffic for the key fields. It collects the non-key fields defined in the flow record. The flow monitor ss the flow record to the SLN-NF-EXPORTER flow exporter, which then ss it to the configured ISR ucs.../0 Control IP address. Configuring a NetFlow Record Configuring the Flexible NetFlow record requires defining key fields on which to match, and nonkey fields containing information to collect as part of the record. You can enter each command individually. You can also paste all the commands into a text editor and update collect timestamp [absolute sys-uptime] first and collect timestamp [absolute sys-uptime] 3

4 Configuring a NetFlow Record last. For supported ISR 4000s, use sys-uptime. For other ISRs, use absolute. After you update the commands, paste them into the command line. flow record SLN-NF-RECORD match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect datalink mac source address input collect datalink mac destination address output collect transport tcp flags collect interface input collect interface output collect flow direction collect counter bytes collect counter packets collect timestamp [absolute sys-uptime] first collect timestamp [absolute sys-uptime] last collect application name collect routing forwarding-status DETAILED STEPS Enter global configuration mode. Step 3 Router# flow record SLN-NF-RECORD Router(config)# flow record SLN-NF-RECORD match ipv4 protocol Creates the SLN-NF-RECORD NetFlow record, and enters flow record configuration mode. Configures the flow protocol as a key field to match on. Step 4 Step 5 Step 6 Router(config-flow-record)# match ipv4 protocol match ipv4 source address Router(config-flow-record)# match ipv4 source address match ipv4 destination address Router(config-flow-record)# match ipv4 destination address match transport source-port Configures the flow source IPv4 address as a key field to match on. Configures the flow destination IPv4 address as a key field to match on. Configures the flow source port as a key field to match on. 4

5 Configuring a NetFlow Record Step 7 Router(config-flow-record)# match transport source-port match transport destination-port Router(config-flow-record)# match transport destination-port Configures the flow destination port as a key field to match on. Step 8 Step 9 collect datalink mac source address input Router(config-flow-record)# collect datalink mac source address input collect datalink mac destination address output Router(config-flow-record)# collect datalink mac destination address output Configures the source MAC address received on an input interface as a nonkey field to collect. Configures the destination MAC address transmitted on an output interface as a nonkey field to collect. 0 collect transport tcp flags Configures the TCP flags as a nonkey field to collect Router(config-flow-record)# collect transport tcp flags collect interface input Router(config-flow-record)# collect interface input collect interface output Router(config-flow-record)# collect interface output collect flow direction Configures the router interfaces on which a packet entered the router as a nonkey field to collect. Configures the router interfaces on which a packet exited the router as a nonkey field to collect. Configures the flow direction as a nonkey field to collect. Router(config-flow-record)# collect flow direction 4 collect counter bytes Router(config-flow-record)# collect counter bytes Configures the total number of bytes in the flow as a nonkey field to collect. 5

6 Configuring a NetFlow Record 5 6 collect counter packets Router(config-flow-record)# collect counter packets collect timestamp {sys-uptime absolute} first Router(config-flow-record)# collect timestamp sys-uptime first Configures the total number of packets in the flow as a nonkey field to collect. Configures the first time the system saw a packet in a flow as a nonkey field to collect. For supported ISR 4000s, use sys-uptime. For other ISRs, use absolute. 7 Router(config-flow-record)# collect timestamp absolute first collect timestamp {sys-uptime absolute} last Router(config-flow-record)# collect timestamp sys-uptime last Configures the last time the system saw a packet in a flow as a nonkey field to collect. For supported ISR 4000s, use sys-uptime. For other ISRs, use absolute Router(config-flow-record)# collect timestamp absolute last collect application name Router(config-flow-record)# collect application name collect routing forwarding-status Router(config-flow-record)# collect routing forwarding-status Router(config-flow-record)# Configures the name of the application used in the flow as a nonkey field to collect. Configures the packet forwarding status as a nonkey field to collect. Exit flow record configuration mode and return to privileged EXEC mode. What to Do Next Configure a NetFlow exporter, as described in the next section. 6

7 Configuring a NetFlow Exporter Configuring a NetFlow Exporter DETAILED STEPS The NetFlow exporter ss NetFlow data to the agent. When you configure the exporter destination IP address, you must use an IP address associated with the agent eth1 interface. You configure this in a later step. You can enter each command individually, or paste all the commands at once from the example below. flow exporter SLN-NF-EXPORTER destination <dla-ip-address> transport udp 6666 template data timeout 300 exit Enter global configuration mode. Step 3 Step 4 Step 5 Step 6 Router# flow exporter SLN-NF-EXPORTER Router(config)# flow exporter SLN-NF-EXPORTER destination dla-ip-address Router(config-flow-exporter)# destination transport udp 6666 Router(config-flow-exporter)# transport udp 6666 template data timeout 60 Router(config-flow-exporter)# template data timeout 300 Router(config-flow-exporter)# Creates the SLN-NF-EXPORTER NetFlow flow exporter, and enters flow exporter configuration mode. Configures the IP address to which the exporter will s flow records. This IP address must be the same as the agent's eth1 IP address if you deploy the agent on a UCS E-Series blade server. Configures the UDP port on which the destination host listens for UDP traffic. Configures sing the flow record template every 300 seconds. Exit flow exporter configuration mode and return to privileged EXEC mode. What to Do Next Configure a NetFlow monitor, as described in the next section. 7

8 Configuring a NetFlow Monitor Configuring a NetFlow Monitor DETAILED STEPS Configure a flow monitor to monitor the traffic traversing an interface. Because the monitor references the flow record and the flow exporter, you must configure the monitor last. You can enter each command individually, or paste all the commands at once from the example below. flow monitor SLN-NF-MONITOR exporter SLN-NF-EXPORTER cache timeout active 60 cache entries record SLN-NF-RECORD Enter global configuration mode. Step 3 Step 4 Step 5 Router# flow monitor SLN-NF-MONITOR Router(config)# flow monitor SLN-NF-MONITOR exporter SLN-NF-EXPORTER Router(config-flow-monitor)# exporter SLN-NF-EXPORTER cache timeout active 60 Router(config-flow-monitor)# cache timeout active 60 cache entries Creates the SLN-NF-MONITOR NetFlow flow monitor, and enters flow monitor configuration mode. Associates the monitor with the SLN-NF-EXPORTER flow exporter you created. Configures the cache timeout for active flows at 60 seconds. Configures the cache to store a maximum of flows. Step 6 Step 7 Router(config-flow-monitor)# cache entries record SLN-NF-RECORD Router(config-flow-monitor)# record SLN-NF-RECORD Associates the monitor with the SLN-NF-RECORD flow record you created. Exit flow monitor configuration mode and return to privileged EXEC mode. 8

9 Assigning a NetFlow Monitor to an Interface Router(config-flow-monitor)# What to Do Next Associate the flow monitor with the ISR's interfaces, as described in the next section. Assigning a NetFlow Monitor to an Interface DETAILED STEPS After you configure the NetFlow flow monitor, assign it to all ISR interfaces that face the branch's users for input and output traffic. This allows the ISR to pass NetFlow flow records to the agent. You can enter each command individually. You can also paste the commands from the example below into a text editor, update the variable, then paste all the updated commands into the command line. If you do this, copy and update the commands for each ISR interface that faces the branch's users. interface <name> ip flow monitor SLN-NF-MONITOR input ip flow monitor SLN-NF-MONITOR output Enter global configuration mode. Step 3 Step 4 Router# interface name Router(config)# interface ip flow monitor SLN-NF-MONITOR input Router(config-if)# ip flow monitor SLN-NF-MONITOR input ip flow monitor SLN-NF-MONITOR output Router(config-if)# ip flow monitor SLN-NF-MONITOR output Specify an interface that faces the branch's users, and enter interface configuration mode. Assign the SLN-NF-MONITOR flow monitor to the interface, and monitor incoming traffic on the interface. Assign the SLN-NF-MONITOR flow monitor to the interface, and monitor outgoing traffic on the interface. 9

10 Assigning a NetFlow Monitor to an Interface Step 5 Step 6 Router(config-if)# Repeat steps 2 through 5 for each remaining interface. Exit interface configuration mode and return to privileged EXEC mode. What to Do Next Deploy the agents to the UCS E-Series blade server. See Installing an Agent on a UCS E-Series Blade Server for more information. 10