NetXplorer NX8.1.0 Centralized NetEnforcer Management Software

Transcription

1 Software Release Notes Version 4 NetXplorer NX8.1.0 Centralized NetEnforcer Management Software PN: D This document details new features, known issues and clarifications concerning NetXplorer software version NX Please check for any updates to this document. New Features... 2 New Applications and Services Resolved Issues Known issues Installing NetXplorer This document contains Proprietary Trade Secrets of Allot Communications LTD and its receipt or possession does not convey any right to reproduce, disclose its contents or to manufacture, use or sell anything that it may describe. Allot reserves the right to make changes, add, remove or change the schedule of any element of this document.

2 NetXplorer Server can be installed on a server running Red Hat Linux, Windows Server 2003 or Windows XP SP2. See the NetXplorer Installation Guide for complete hardware requirements. NX8.1.0 must be installed either as an upgrade from version NX7.1.x/ NX7.3.x/ NX7.5.x or on a clean server. NOTE Please contact Allot Customer Support to upgrade from NX To obtain the NetXplorer software version: Launch the NetXplorer GUI. Select About NetXplorer from the Help menu. The following screen appears: If the version number is NX7.4.0, please contact Allot Customer Support before the upgrade NetXplorer server running NX8.1.0 can operate with NetXplorer Monitoring Collectors that have software version M7.5.0 or M8.1.0 installed. The recommended RAM for the NetXplorer server machine is 4GB. The minimum RAM requirement for the NetXplorer server machine is 2GB. When upgrading NetXplorer from NetXplorer 7.X versions, new key has to be issued. NetPolicy Provisioner allows your customers to monitor and control their bandwidth usage for themselves. The NetPolicy Provisioner (NPP) enables service providers to quickly and easily define views that enable their customers (the end users) to monitor and provision their own traffic and their network's current behavior. Typically, when customers acquire bandwidth from ISPs, the bandwidth allocation is represented in the NetEnforcer of the ISP by a Pipe or Virtual Channel Allot Communications. All rights reserved. 2

3 When customers want to monitor the traffic passing through their Pipe or Virtual Channel, NPP enables them to do this. Using the NPP interface, the service provider defines a view, which allows the monitoring and management of the traffic on Pipe or Virtual Channel. When defining a customer s level of access, the NetXplorer administrator selects the view relevant to that customer, and then the end user will be given access to this data only. Customers can access the view (or views) assigned to them by browsing to a unique URL. This URL is automatically created by NPP and designates an HTML index file from which a customer can access his views. After entering a user name and password, customers can also view the monitoring graphs of their Pipe or Virtual Channel, and obtain relevant and current traffic usage data. This version was enhanced security with greater means to protect the interfaces between the NetXplorer management and the NetEnforcer devices. NX8.1.0 now allows you to establish a secure connection via HTTPS between NetXplorer clients and the NetXplorer server as well as a secure connection between the NetXplorer server and the NetEnforcer devices via SSL. Allot s extensive monitoring capabilities have been increased with new monitoring offerings: Distribution Graphs on Service groups The NetXplorer now has the ability to generate distribution graphs on Service groups. The user may see a variety of bandwidth counters such as total/inbound/outbound bandwidth, CER/Open connections, etc on Service groups such as P2P Applications / VoIP / etc. Figure 1 - Service Groups Distribution Report Bandwidth Usage Percentiles This report shows the average usage for different subscriber groups according to the percentile of the used bandwidth. Based on the samples measured for each subscriber, the report will show the average bandwidth per different subscriber groups that contain 5%, 10%, 25%, 50%, 90 and 95% of the most active subscribers as illustrated below: 2008 Allot Communications. All rights reserved. 3

4 Figure 2- Bandwidth Usage Percentile Report The report also shows the number of hosts/subscribers that belong to each group. Protocols Percentile Distribution This report allows the user to monitor protocol distribution of the average bandwidth per specific subscribers/hosts group as described in the Bandwidth Usage Percentiles report. The report can be opened from the right click menu on the Network Tree or as a drill down into one of the bars from the Bandwidth Usage Percentiles report. Figure 3- Long Term Reporting: Percentile Protocols dialog 2008 Allot Communications. All rights reserved. 4

5 Figure 4 - Protocol Percentile Report 95 Percentile reports The 95% value (metered bandwidth) is used for billing by most Tier -1 operators and carriers and is calculated based on 5 minutes rules samples over the month. This report is available based on either subscribers or IPs and can be generated on the NetEnforcer, Line, Pipe, VC or Protocol level. Pipes / VCs Popularity This report shows the most popular pipes/vc based on the number of active instances. The report is useful primarily for ISPs and is used to calculate the number of active subscribers over the selected time period per service plan. This report is relevant for Pipe/VC templates only. Subscribers Quota Reports Two reports have been added to monitor subscriber quota usage: o Most Active Subscriber for the Selected Service Plan This report shows the most active subscribers per service plan based on Total Quota/In Quota/Out Quota Allot Communications. All rights reserved. 5

6 Figure 5 - Most Active Subscribers report based on Total Quota Us age o Service Plan Quota Distribution report This report shows detailed information about the quota usage for selected service plan(s) over predefined period of time. The displayed value is the summary of quota usage for all subscribers assigned to the specific service plan. Figure 6 - Service Plans Quota Distribution Report These reports can be displayed based on total quota usage (the value is displayed as a percentage of the defined quota) or on total volume. Service Plan Quota Report This report allows the traffic volume used by selected service plan(s) to be monitored during a selected period of time. The report can be based on Total Quota Usage or on Total Quota Volume. If Total Quota Usage is selected, the value displayed is the percentage of the used bandwidth comparing to the allocated quota. The report can be generated as a Long Term report on the Network level only Allot Communications. All rights reserved. 6

7 Figure 7 - Service Plan Quota Distribution based on quota usage Compound Reports A Compound Report is a report which consists of several monitoring reports distributed together in a single pdf file. The compound pdf file can be generated periodically and sent by to the customer. Compound Reports can include any of the scheduled reports defined in the Report list of the Reports Tab as illustrated below: Figure 8 Compound Reports Properties Compound reports are especially useful for executive summaries. NOTE A report has to be defined in pdf format in order to be added to the compound report. Reports Folders In order to make NetXplorer reports easier to categorize, the NetXplorer now has the option to create folders. The folders allow the user to categorize the reports by time period, policy, devices, etc. User has ability to define user specific folders and organize the reports into these folders Allot Communications. All rights reserved. 7

8 Predefined reports The following pre-defined system reports are now available: Network statistics for the last hour in 5 minutes resolution Network statistics for the last day in hourly resolution Network s 10 most Active Hosts stacked by protocol for the last hour in 5 minutes resolution Network s 10 most Active Hosts stacked by protocol for the last day in hourly resolution Network s 10 most Active Protocols for the last hour in 5 minutes resolution Network s 10 most Active Protocols for the last hour in 5 minutes resolution Network s 10 most Active Protocols for the last day in hourly resolution hour in 5 minutes resolution Network s 10 most Active Hosts stacked by protocol for the last day in hourly resolution Network s 10 most Active Hosts stacked by protocol for the last day in hourly resolution Allot s NetXplorer centralized management server now supports the RedHat Enterprise Server 5 operating system. System administrators can choose to install Allot s management solution on either Windows OS or Linux OS. NOTE Please contact Allot Customer Support for assistance in administration related operations such as database backup and recovery issues on the NetXplorer Server when installed on Linux OS. Keep your network up-to-date with Protocol Updates. The ability to better monitoring and control your network depends on the ability to keep up with changes in the services & protocols running on that network. Every day new services & protocols appear and existing services & protocols are changing which may affect the way your network behaves. Using the NetXplorer APU, you will be able to keep track of these changes more efficiently, choose updates relevant to your network and be able to guarantee that your network will function as expected. Service Catalog entries may be updated from the Allot Communications Website where the latest Protocol Packs are maintained Allot Communications. All rights reserved. 8

9 NetXplorer periodically checks Allot s website for the latest available Service Catalog information and you can update Service Catalog entries on the NetXplorer Server as well as install them on selected NetEnforcer Devices, as required. The Service Catalog updates for the NetXplorer Server and assigned NetEnforcers may be performed automatically or manually. NetXplorer also provides a rollback mechanism that enables you to return to a pervious version of the appropriate Service Catalog entries. To update Service Catalogs, select the appropriate option from the NetXplorer Tools menu and the Protocol Update wizard guides you through the NetXplorer Server and NetEnforcer update processes. Where necessary, you can also update Service Catalog entries from local media, such as CDs and disc drives. This feature is available with E8.1.x/S8.1.x/C8.1.x versions. Allot NetXplorer speaks your language. Now you can control the language of the management server. This version supports the following languages: English. Chinese. Russian. Allot NetXplorer exports monitoring data to CSV files on the NetXplorer server or a remote server in a variety of formats including Allot legacy formats in order to better integrate with customers environments. In order to ensure stability of the Allot NetXplorer management solution, NetXplorer Monitoring Collectors mediation device can now be redundant. If one of the collectors fails the other collector will make sure no data is lost, since the monitoring data is stored on both collectors Allot Communications. All rights reserved. 9

10 The following updates with respect to NX The following services will be added/deleted to/from the Service Group automatically during the NetXplorer upgrade. The Service has to exist in the Service catalog in order to be added to the service group automatically. New Applications that are added automatically during NetXplorer upgrade: MySpace (ID 169) MySpaceIM (ID 170) Facebook (ID 171) CNN Streaming (ID 172) AOL Streaming (ID 173) AOL Radio (ID 174) GameSpy (ID 175) IM Plus (ID 176) BitTorrent Enc (ID 177) BitTorrent Tracker (ID 178) edonkey Enc (ID 179) New Services that are added automatically during NetXplorer upgrade: Other Games MySpace MySpaceIM Facebook CNN Streaming AOL Streaming AOL Radio GameSpy IM Plus BitTorrent Enc BitTorrent Tracker edonkey Enc Service Group Games P2P Applications Web Applications Instant Messaging Applications Streaming Applications File Systems Service Group Members Services added - Other Games ; GameSpy Services added NNTP ; BitTorrent Enc ; BitTorrent Tracker ; edonkey Enc Services deleted NNTP Services added MySpaceIM ; IM Plus Services added Kontiki ; MySpace ; Facebook ; CNN Streaming ; AOL Streaming ; AOL Radio Services deleted Kontiki 2008 Allot Communications. All rights reserved. 10

11 A limit of 5Gbps in the QoS catalog definitions was updated to 20Gbps to enable support for the SG Omega series. Changing a Time Catalog entry an entry from AM to PM at the daily option no longer disables the save option. Support for 10G interfaces was added in order to support the SG Omega series. Performance of large scale Host catalogs was improved significantly. In the ToS catalog, an extra validation step was added to make sure ToS byte 255 is invalid. Better support of for Unicode characters has been added to enable Localization. Improved error messages. All GUI windows may now be resized. No Virtual Channel names are truncated. Validation problems were resolved in the Server CLI. All scheduled reports properties now saved after editing. Changing the time zone on the NetXplorer no longer prompts a reboot of the devices. In the policy table, the save button no longer is enabled if no change was made. Active Redundancy requires a license in order to become active, but parameters may still be defined without a license, it simply will not be enabled. A description field enabling the user to add his comments on the entry is now available in the connection control catalog list. The Service Catalog is now sorted properly. SMP interface was improved to better support new SMP versions. When adding a collector to NetXplorer server, time configurations can now be opened. Occasionally no data was shown in Long Term Monitoring graphs due to a failure in month aggregation. This issue has been solved Allot Communications. All rights reserved. 11

12 The minimum required specs for version NX8.1.0 have been changed and 4GB of RAM is now required instead of 2GB RAM. All other specs remain unchanged. NX8.1.0 is not supported on 64 bit servers. When working with a NetEnforcer version lower then E7.4.0/S7.1.3/C7.1.3/C7.2.0, the SNMP device access settings must not be changed via the SNMP v3 tab under Network Configuration. Doing so may disable SNMP communication to the device. Loss of SNMP connectivity to the device will lead to the failure of catalogs/policy updates. For complete instructions on restoring the original SNMP v3 User Name and Pass Phrase, see the Allot Knowledge Base at item #6297. While changing and saving NetEnforcer running version E7.4.0 or C7.2.0 NIC configuration, the error message that the device should be rebooted appears. The message is false; there is no need to reboot the device. Please make sure that port TCP: 443 is open when using NPP. If deleting a service from the service catalog immediately after deleting a Pipe/VC with that service, the operation may fail with an error message reading Catalog entry might be in use in a device policy. Reloading the service catalog or retrying after a few seconds will resolve the problem. Most Active Conversations and Most Active External Hosts reports will open empty for AC-1000/AC-2500 Series devices. Distribution Reports no longer include From Time and To Time fields. The rest of the fields appear with no change. In order to generate the Average popularity reports, the relevant key should be activated on the NetEnforcer device. By default this key is turned off. To activate the key on the NetEnforcer device, perform the following steps: 1. Change the parameter srvc_enable to 1 in the allotconfig.xml file located on the NetEnforcer device: <srvc_enable>1</srvc_enable> 2. Reboot the NetEnforcer An alarm that was edited after it was assigned to the Line/Pipe/VC will not function. To remove the alarm from Line/Pipe/VC, edit it and then reassign it to the relevant policy objects Allot Communications. All rights reserved. 12

13 Values defined in the Connection Control Catalog could be used in the policy definitions on the devices that currently do not support redirection. No error message will be displayed. The Fallback Pipe in each Line other than the Fallback Line is inactive in this release. Traffic will not be classified to these Fallback Pipes. This is relevant only for AC-400/AC- 800 Series devices that support multiple lines. Changing Line QoS of AC-1000/AC2500 Series devices will cause the device to reboot. No warning message will be displayed. Policy distribution does not include distribution of any alarms assigned to the Line/Pipe/VC It is not possible to map the same text file to multiple host groups. Customers that upgraded from the NX7.3.x must delete previously defined external text files host groups from the host catalog and then add them again. o While upgrading from NX8.1.0 to the next version there will be no need to perform this operation. Defining a new Host entry and a new Host group and then assigning this new host entry to the new host group via CLI on the NetEnforcer device might cause full export to the device. It might take few minutes to open Host group entry that contains several thousands host entries. The NetXplorer does not allow time catalog entries to be saved if the entry begins in PM and ends in AM. To save such an entry it is recommended that two parameters be defined, one ending at 12:00 AM and the second starting at 12:00 AM. If one of these services is used in the policy, it won t be automatically deleted from the Service Catalog during the NetXplorer software upgrade. The user will be able to delete it manually after deleting the relevant policy first. If the user will not delete the relevant policy manually, the traffic will no longer classify to this policy and presented in the monitoring reports Allot Communications. All rights reserved. 13

14 It is strongly recommended that a second NTP Server be defined for NetXplorer in addition to the NTP server installed with NetXplorer itself. An external NTP server should be defined during installation after selecting Custom installation. If an external NTP Server was not defined at installation, it must be defined manually. To do so, the following process must be performed on the NetXplorer Server machine. Configure the time setting on the server machine as follows: 1. Click Start on the Windows Task Bar and select Control Panel. 2. Double-click Date and Time Properties dialog box, 3. On the Internet Time tab, deselect automatically synchronize with an Internet time server. 4. Click Start on the Windows Task Bar and select Control Panel 5. Double-click Administrative Tools and open Services. 6. Disable the Windows Time service. 7. Enable the Network Time Protocol service Allot Communications. All rights reserved. 14

15 8. Close the Service window. NOTE Please refer to E8.1.0/S7.1.3/ C7.2.0 Release Notes for additional known issues related to the NetEnforcer devices Allot Communications. All rights reserved. 15

16 NetXplorer Server should be installed on a machine running Windows 2003 Server or Windows XP SP2 or Red Hat Linux. NetXplorer User Interface should be installed on a PC utilizing a Pentium 4 processor and 512MB RAM. Microsoft Windows XP and Microsoft Internet Explorer must be installed. X virtual frame buffer package has to be installed prior to NetXplorer installation on Linux OS Any real-time virus protection programs or automatic defragmentation/backup software must be disabled on the NetXplorer Server or the Allot folder needs to be excluded from protection/defragmentation. Java SDK 1.6 and higher should be installed on the Server before installing NetXplorer. Please make sure that in addition to the ports specified in the NetXplorer Installation Guide, port TCP:8093 is open. 1. Log into the ftp site with anonymous login account (no password is required). 2. Type cd AC-Releases/Current_Versions/NetXplorer/NetXplorer_Server Please note that the NetXplorer files are approximately 800MB and will take some time to download. They are compressed and must be opened with WinZip or another utility. For complete instructions and full installation procedures, see the NetXplorer Installation Guide and NetXplorer Operation Guide from Java SDK should be upgraded to version 1.6 before upgrading NetXplorer server. It is strongly recommended to backup the NetXplorer Database before upgrading the NetXplorer Server. 1. Stop the NetXplorer Service. 2. Click Start on the Windows Task Bar and select Settings > Control Panel. 3. Double-click Administrative Tools and open Services. 4. Right-click NetXplorer in the list of Services and select Stop from the drop-down menu. 5. Check the allot_ltc.txt, allot_stc.txt log files located under Allot Home Directory\Logs in order to verify that NetXplorer services are not running: 2008 Allot Communications. All rights reserved. 16

17 The following lines should appear in both allot_ltc.txt, allot_stc. txt log files: "Disable all events" "End of current events" 6. Copy Allot Home Directory\data\db folder to a backup directory 7. Restart the NetXplorer Service. Click Start on the Windows Task Bar and select Settings > Control Panel. Double-click Administrative Tools and open Services. Right-click NetXplorer in the list of Services and select Start from the drop-down menu. 1. Verify the NetXplorer server machine name wasn t changed. In case the NetXplorer server machine name was changed, the old computer name should be restored before starting the upgrade procedure. To obtain the computer name: Make a right click on the My Computer icon located on the Desktop and Select Properties Select Computer Name Tab The computer name appears on this Tab 2. Stop the NetXplorer Service as outlined in Database Backup. 3. Open the Windows Task Manager by pressing <CTRL + ALT + DEL> and clicking the Task Manager Button. Select the Processes tab and confirm that DbSrv9.exe does not appear in the list. 4. Install NetXplorer as described under New Installation. 5. There is no need to remove a previous installation. It will be detected automatically by the Installation Wizard. 6. The NetXplorer Service will be stopped automatically when the upgrades starts. It will resume operation after the server is rebooted following the upgrade. 7. At the end of the upgrade procedure you will be asked to reboot the NetXplorer Server. Please note that if the NetXplorer Server will be down for more then 25 minutes, Real Time (Short Term) data after this period will be lost and data collection will be continued only after the server is up again. Therefore it is recommended to perform the upgrade during low traffic hours. The NetXplorer Monitoring Collector is supplied as an Allot s appliance and can not be installed on other server. NetXplorer Collector software can be reinstalled using the NetXplorer Collector Recovery CD or by downloading the Collector installation file from Allot s ftp site only. To download NetXplorer Collector installation file: 1. Log into the ftp site with anonymous login account (no password is required). 2. Type cd /AC-Release s/current_versions/netxplorer/netxplorer_collector 2008 Allot Communications. All rights reserved. 17

18 A NetXplorer collector running M7.1.x/M7.3.x must have the M8.1.0 software overwrite the previous version. See the Monitoring Collector Installation Guide for complete installation procedure and initial configuration. Before starting work with a Collector newly upgraded to M8.1.0, the following steps must be performed: Connect a monitor and keyboard to the appropriate connectors of the NetXplorer Collector. When prompted, enter admin for the login and allot for the password. Enter the following command to switch to root user access: su When prompted, enter the following password: tarantallegra Enter the following command to set the appliance mode the collector: chmod +x dc-inst.sh Enter the following command to define the appliance as a collector opt/allot/dev_setup.sh m stc Reboot the collector NOTES Until this procedure is completed, the Collector is unreachable alarm will appear in the NetXplorer GUI. Short Term monitoring data (up to 6 hours) will be lost during collector reinstallation Allot Communications. All rights reserved. 18