NetFlow Traffic Analyzer

Transcription

1 GETTING STARTED GUIDE NetFlow Traffic Analyzer Version Last Updated: Friday, July 28, 2017 Retrieve the latest version from:

2 2017 SolarWinds Worldwide, LLC. All rights reserved. This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its respective licensors. SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The SolarWinds and other SolarWinds marks, identified on the SolarWinds website, as updated from SolarWinds from time to time and incorporated herein, are registered with the U.S. Patent and Trademark Office and may be registered or pending registration in other countries. All other SolarWinds trademarks may be common law marks or registered or pending registration in the United States or in other countries. All other trademarks or registered trademarks contained and/or mentioned herein are used for identification purposes only and may be trademarks or registered trademarks of their respective companies. page 2

3 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Table of Contents NetFlow Traffic Analyzer Getting Started Guide 5 Prerequisites 5 Product terminology 6 How SolarWinds NTA works 7 Flow monitoring architecture 7 CBQoS monitoring architecture 7 How NTA licensing works 8 Production installation 9 Multi-module system guidelines 10 Small deployment guidelines 10 Medium deployment guidelines 11 NTA-specific information 12 Large deployment guidelines 12 NTA-specific information 14 NTA Flow Storage Database requirements 15 Install the SolarWinds NTA Flow Storage Database 16 Before you begin 16 How to install the NTA Flow Storage Database 16 Install a licensed copy of SolarWinds NTA 18 Before you begin 18 Install SolarWinds NTA 18 Configure the Orion Server and database 18 Evaluation installation 20 Install an evaluation copy of SolarWinds NTA 21 Populate SolarWinds NTA with devices 23 page 3

4 Discovery for SolarWinds NTA 24 Set up your flow environment 25 What protocols does SolarWinds NTA support? 26 Flow environment best practices 28 Determine where to enable flow 28 Be mindful of directionality and duplication 28 Calculate the size of your Flow Storage Database 29 Set the retention period 29 Enable a device to send flow data to SolarWinds NTA 31 Requirements 31 Enable a device to send flow data 31 Identify consumers of interface bandwidth 32 Identify consumers of interface bandwidth 33 Change the threshold for Top Talker alerts 33 Identify top talkers when the interface bandwidth utilization alert is triggered 35 Keep close track of bandwidth utilization 39 Plan for interface bandwidth capacity 42 Bandwidth capacity planning and analysis 43 Generate a WAN Interfaces Last 7 Days report 43 Beyond getting started 47 page 4

5 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER NetFlow Traffic Analyzer Getting Started Guide Welcome to the SolarWinds NetFlow Traffic Analyzer (NTA) Getting Started Guide. This guide takes you from installation to implementation and includes the following sections: How SolarWinds NTA works: How flow analysis and CBQoS function. Production installation: How to install SolarWinds NTA into an existing SolarWinds Orion deployment. Evaluation installation: How to install an evaluation copy of SolarWinds NTA. Set up your flow environment: How to correctly set up your flow environment and process flow data. Populate SolarWinds NTA with devices: How to add discovered devices to SolarWinds NTA. Identify consumers of interface bandwidth: How to identify which users, apps, and locations are consuming bandwidth. Plan for interface bandwidth capacity: How to report on current and historical performance to plan for business needs. Ensure your long term success with SolarWinds NTA by following the guidelines described in this guide. Depending on your workload, getting started with SolarWinds NTA should take you one day or less. Existing customers: Follow the recommendations in this guide to ensure your system capabilities are appropriate and your production environment is sized correctly. Minimum system requirements used during evaluation are not sufficient for a production environment. Access your licensed software from the SolarWinds Customer Portal. If you need implementation help, contact our Support team. Evaluators: To evaluate SolarWinds NTA, download a free 30-day evaluation. The evaluation version of SolarWinds NTA is a full version of the product, functional for 30 days. If you evaluate SolarWinds NTA on a Windows Server operating system, you can easily convert your evaluation license to a production license by obtaining and applying a license key. If you need assistance with your evaluation, contact sales@solarwinds.com. Prerequisites This getting started guide assumes that you have: Purchased or are evaluating SolarWinds Network Performance Monitor (NPM) and SolarWinds NetFlow Traffic Analyzer (NTA). Installed SolarWinds NPM and are adding SolarWinds NTA to your SolarWinds Orion Platform deployment. page 5

6 Completed the SolarWinds NPM Getting Started Guide. There are some very important principles and skills that you learn in the SolarWinds NPM Getting Started Guide, so SolarWinds highly encourages you to work through that content. Collected the details for accessing the SolarWinds Orion Database. The following are prerequisites for installing the SolarWinds NTA Flow Storage Database: o o Valid host name or IP address of the server where the SolarWinds Orion SQL database is installed SQL database credentials Product terminology Orion Platform: The common backend platform used by the SolarWinds Orion suite of products, including Network Performance Monitor (NPM), Server & Application Monitor (SAM), Network Configuration Manager (NCM), NetFlow Traffic Analyzer (NTA), and more. The platform provides the backbone for navigation, settings, and common features like alerts and reports. It also provides a consistent look-andfeel across products, giving you a single pane of glass for your SolarWinds Orion monitoring tools. Orion Web Console: The web interface you see when you log in to SolarWinds Orion that is used to view, configure, and manage all of your monitored objects. Check out this video on navigating the Web Console. Orion Application Server: A Microsoft Windows server that runs the Orion Web Console and collects data from monitored objects. Also called the Orion Main Poller. Orion Database Server: A Windows SQL server that should be hosted on a dedicated server in a production environment, separately from the Orion Application Server. It stores SolarWinds Orion configuration data and all collected performance and syslog data. Polling Engine: A polling engine controls polling job scheduling, data processing, and queries your monitored devices for performance metrics, such as CPU, memory, and up or down status. Additional Polling Engines can be licensed to provide additional scalability and capacity. By default, the Orion Server provides one polling engine (often referred to as the Main Polling Engine). NTA Flow Storage Database: An independent database for storing flow data. The SolarWinds NTA Flow Storage Database must be installed before installing SolarWinds NTA. NetFlow collector: A server responsible for receiving, storage, and processing of flow data. CBQoS: Class-Based Quality of Service (CBQoS) is an SNMP-based, proprietary Cisco technology available on selected Cisco devices that gives you the ability to prioritize and manage traffic on your network. For more information about configuring class maps for your CBQoS-enabled network devices, search CBQoS at page 6

7 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER How SolarWinds NTA works SolarWinds NTA collects Class Based Quality of Service (CBQoS) and flow data, processes it, and together with performance data collected by SolarWinds NPM, presents the data in graphs and reports to show bandwidth use on your network. These reports help you: Monitor interface-level network bandwidth usage, and identify users, applications, protocols, and IP address groups that consume most bandwidth. Track conversations between internal and external endpoints. Analyze traffic patterns, with up to one-minute granularity, over months, days, or minutes by drilling down into any network element. Enhance bandwidth capacity before outages occur. Flow monitoring architecture The Orion Platform is used to power SolarWinds products, including SolarWinds NTA. It provides centralized administration, access control, and alerting and reporting. The Orion Web Console is the web interface used for navigating through the NetFlow Summary page, managing SolarWinds NTA settings, or common Orion features like alerts and reports. The following diagram shows how data travels from flowenabled network devices to the SolarWinds NTA collector, which collects the data and inserts it into the SolarWinds NTA Flow Storage Database. CBQoS monitoring architecture CBQoS implementations work much the same way as flow-enabled implementations, except that the NetFlow collector polls each device and returns data that meets the CBQoS policies you have defined. The system keeps collected data in the SolarWinds Orion Database. The Orion Web Console is then used to navigate through the dashboard, manage the product settings, or the common features of the Orion Platform products, such as alerts and reports. For more information about CBQoS implementations, see View CBQoS data in the NTA Administrator Guide. page 7

8 How NTA licensing works Licensing for SolarWinds NTA follows the license level of your SolarWinds NPM installation. For example, if you have an NPM license for SL250, your SolarWinds NTA license is also SL250. When upgrading licenses, the license levels must match. For example, when you upgrade an NPM SL250 license to SL500, you must upgrade your SolarWinds NTA license to SL500. The following SolarWinds NetFlow Traffic Analyzer for SolarWinds Network Performance Monitor licenses are available: SL100 SL250 SL500 SL2000 SLX For more information on checking your SolarWinds NTA licenses, see How to check licenses in the Orion Web Console. page 8

9 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Production installation This section contains the following topics: Multi-module system guidelines NTA Flow Storage Database requirements Install the SolarWinds NTA Flow Storage Database Install a licensed copy of SolarWinds NTA page 9

10 Multi-module system guidelines If you have more than one Orion Platform product, use these recommended guidelines for hardware and software deployment. The information here should be considered guidelines only. You can choose to use more or less hardware but your performance may vary depending on your deployment scenario. If you have only one Orion module, refer to the system requirements listed in the administrator s guide for that module. SMALL DEPLOYMENT GUIDELINES Modules You can install NTA as part of a small deployment, but it is not included in this configuration. Use the Medium Deployment guidelines for NTA. Choose up to 3 modules: NPM SL100 - SL500 (including up to 10 remote agents for DPI) SAM AL150 - AL300 WPM 5 - WPM 20 VNQM IPSLA 5 - IPSLA 25 (up to 5,000 operations) NCM DL50 - DL200 IPAM IP IP4000 UDT UT Orion Application Server Specifications Physical server or virtual machine Quad core processor or better 8-16 GB RAM 150 GB, 15,000 RPM 1 x 1 Gb dedicated NIC Windows Server 2016, 2012 R2, 2012, or 2008 R2 SP1 The Orion installer installs IIS (32-bit mode) and.net 4.5 if they are not already on your server. SQL Database Server Specifications Physical server recommended Quad core processor or better 16 GB RAM 100 GB 1 (or more) storage in RAID 1+0 configuration (RAID 5 not supported) Windows Server 2016, 2012 R2, 2012, or 2008 R2 SP1 Microsoft SQL Server 2016, 2014, 2012, or 2008 R2 Standard Edition page 10

11 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER 1 More or less space may be needed depending on your data retention policies, number of elements measured, and polling frequency. MEDIUM DEPLOYMENT GUIDELINES Modules NPM SL500 - SL2000 NTA for NPM SL ,000 FPS received sustained on the main poller 2-4 additional modules: SAM AL700 - AL1100 WPM 50 - WPM 200 VNQM IPSLA 25 - IPSLA 50 (up to 10,000 operations) NCM DL500 - DL1000 IPAM IP16,000 UDT UT10,000-25,000 Orion Application Server Specifications Physical server or virtual machine Quad core processor or better 16 GB RAM 150 GB, 15,000 RPM 1 x 1 Gb dedicated NIC Windows Server 2016, 2012 R2, 2012, or 2008 R2 SP1 The Orion installer installs IIS (32-bit mode) and.net 4.5 if they are not already on your server. SQL Database Server Specifications Physical server recommended Dual quad core processor or better 64 GB RAM 250 GB 2 (or more) storage in RAID 1+0 configuration (RAID 5 not supported) Hardware RAID Controller (software RAID not supported) Windows Server 2016, 2012 R2, 2012, or 2008 R2 SP1 Microsoft SQL Server 2016, 2014, 2012, or 2008 R2 Standard Edition NTA Flow Storage Database Server Specifications Physical server or virtual machine Quad core processor or better 16 GB 3 RAM page 11

12 100 GB - 1 TB 4 of storage capacity on local NTFS disk 1 x 1 Gb dedicated NIC Windows Server 2012 R2, 2012, or 2008 R2 SP1 NTA-SPECIFIC INFORMATION NTA If the server is running a 32-bit operating system, NTA 4.0 stores flow data in the SQL Database (NTA Flow Storage Database is not installed). For more information, see Requirements for the Orion Database Server and NTA 4.0 Installation: Frequently Asked Questions. NTA NTA 4.1 only works with a 64-bit operating system. SolarWinds recommends a separate NTA Flow Storage Database. 2 More or less space may be needed depending on your data retention policies, number of elements measured, and polling frequency. 3 RAM for the NTA Flow Storage Database should be increased as the database size increases. 4 More or less space may be needed depending on your data retention policies and the number of flows stored. You need approximately 8 GB of additional storage for every 1000 flows that are retained for 30 days. For example, if you want 50,000 flows stored for 30 days, you need a base of 100 GB plus an additional 400 GB of storage. LARGE DEPLOYMENT GUIDELINES Modules NPM SLX (with multiple pollers) NTA for NPM SLX 50,000 FPS received sustained on the main poller Up to 6 pollers (5 in addition to the main poller) for 300,000 FPS received sustained Any combination of these modules: SAM ALX 1 APE for every 10,000 component monitors Maximum of 50,000 component monitors per primary Orion SAM server + 4 APEs VNQM IPX ~5,000 IP SLA operations per polling engine NCM DLX 1 APE for every 10,000 devices, for NCM 7.1 and later Maximum of 30,000 devices per NCM instance (that is, NCM server + 2 NCM APEs) page 12

13 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER IPAM IPX 750,000 IP UDT UTX 150,000 ports per polling engine Orion Application Server Specifications Physical server or virtual machine Quad core processor or better 32 GB RAM 150 GB, 15,000 RPM 1 x 1 Gb dedicated NIC Windows Server 2016, 2012 R2, 2012, or 2008 R2 SP1 The Orion installer installs IIS (32-bit mode) and.net 4.5 if they are not already on your server. SQL Database Server Specifications Physical server recommended Dual quad core processor or better 128 GB RAM Hardware RAID Controller (software RAID not supported) Disk Subsystem 1 Array 1: 2 x 146 GB 15,000 disks RAID 1 (mirroring) operating system Disk Subsystem 2 Array 2: 2 x 146 GB 15,000 disks RAID 1 (Pagefile + extra storage) Disk Subsystem 3 Array 3: with 6x 15, GB or 300 GB disks configured in a RAID 1+0 arrays to allow for maximum write performance. This is for your SQL MDF AND FILEGROUPS Disk Subsystem 4 Array 4: with 4x 15, GB or 300 GB disks configured in a RAID 1+0 arrays to allow for maximum write performance. This is for your SQL LDF Transaction LOG file Disk Subsystem 5 Array 5: with 4x 15k 146 GB or 300 GB disks configured in a RAID 1+0 array for your tempdb data file Disk Subsystem 6 Array 6: with 4x 15k 146 GB or 300 GB disks configured in a RAID 0 array for your tempdb log file 1 Gb LAN port Windows Server 2016, 2012 R2, 2012, or 2008 R2 SP1 Microsoft SQL Server 2016, 2014, 2012, or 2008 R2 Standard Edition page 13

14 NTA Flow Storage Database Server Specifications Physical server or virtual machine Quad core processor or better 16 GB 3 RAM 100 GB - 1 TB 4 of storage capacity on local NTFS disk 1 x 1 Gb dedicated NIC Windows Server 2012 R2, 2012, or 2008 R2 Additional Polling Engine Server Specifications Virtual machine recommended Quad core processor or better 32 GB RAM 150 GB, 15,000 RPM 1 x 1 Gb dedicated NIC Windows Server 2016, 2012 R2, 2012, or 2008 R2 The Orion installer installs IIS (32-bit mode) and.net 4.5 if they are not already on your server. NTA-SPECIFIC INFORMATION NTA If the server is running a 32-bit operating system, NTA 4.0 stores flow data in the SQL Database (NTA Flow Storage Database is not installed). For more information, see Requirements for the Orion Database Server and NTA 4.0 Installation: Frequently Asked Questions. NTA NTA 4.1 only works with a 64-bit operating system. SolarWinds recommends a separate NTA Flow Storage Database. page 14

15 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER NTA Flow Storage Database requirements SolarWinds NTA stores NetFlow data in the NTA Flow Storage Database. TYPE CPU RAM Hard drive space REQUIREMENTS 3 GHz or faster Evaluation requires 2 CPUs Production environments require 4 CPUs or more (4-16 CPUs) Evaluation requires 8 GB or more Production environments require 16 GB or more ( GB) To ensure optimal performance, you should increase RAM together with the database size. 20 GB on 7200 RPM disk or more With the default 30-day retention period and default top talker optimization that records only those flows that represent conversations requiring the most bandwidth on your network, you should plan at least 8 GB of additional storage capacity per sustained 1000 flows per second. The required hard drive space strongly depends on your flow traffic, and SolarWinds recommends you provide more space accordingly. NTFS file system required The only RAID configurations that should be used with SolarWinds NTA are 0 or 1+0. Other RAID or SAN configurations are not recommended, as they can result in data loss and significantly decreased performance. OS 64-bit operating system: Microsoft Windows Server 2008 SP2 and later.net Framework 4.5 If it is not already installed,.net Framework auto-installs with the SolarWinds NTA Flow Storage Database page 15

16 Install the SolarWinds NTA Flow Storage Database BEFORE YOU BEGIN Access the Customer Portal to download the installation files. Install the SolarWinds NTA Flow Storage Database on a different server than the SolarWinds Orion database, so that incoming flows do not affect performance of the Flow Storage Database. In case you want to use SAN storage, please make sure your environment meets the IOPS requirements for the NTA Flow Storage Database server. Solid-state drives (SSD) are recommended for all components. Do not install the SolarWinds NTA Flow Storage Database on a polling engine, because it might affect performance. Additional polling engine is not supported. Use a dedicated disk or LUN to store flow data. We do not recommend installing the NTA Flow Storage Database on the C:\ drive. Do not run anti-virus software or any other file scanning application over data in the SolarWinds NTA Flow Storage Database. File scanning applications affect the database performance and may prevent the database from running properly. You can also review antivirus exclusions for all Orion products. For more information, see Files and directories to exclude from antivirus scanning. Ensure the NTA Flow Storage Database server meets the NTA Flow Storage Database requirements. Install SolarWinds NPM. Collect the host name or IP address of the Orion database, the Orion database name, and credentials. HOW TO INSTALL THE NTA FLOW STORAGE DATABASE 1. Log in to the server where you want to store your flow data. 2. Launch the installation file SolarWinds-Orion-NTA-<version>.exe from the download location. The installer used is the same as for installing SolarWinds NTA on the application server. 3. Review the Welcome information, and click Next. 4. Select I Would Like to Install the NTA Flow Storage Database on This Server. page 16

17 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER 5. Enter the details for accessing the SolarWinds Orion database: a. In the Orion database server field, enter a valid host name or an IP address of the server where the Orion SQL database is installed. b. In the Orion database user name and password field, enter the SQL database credentials. The default Orion database user name is SolarWindsOrionDatabaseUser. You specified the password in the Configuration wizard when you installed SolarWinds NPM. c. Select a database, and click Test Connection. d. Click Next to continue. 6. Specify the installation folder, and click Next. The best practice is to install the Flow Storage Database on a disk other than C:\. 7. Click Install. 8. When the installation completes, click Finish. page 17

18 Install a licensed copy of SolarWinds NTA BEFORE YOU BEGIN Install the SolarWinds NTA Flow Storage Database. Download the installation file SolarWinds-Orion-NTA-<version>.exe from the SolarWinds Customer Portal. Collect the SolarWinds NTA Flow Storage Database server host name or IP address. As your database size increases with the addition of more flow-enabled devices, consider first collecting NetFlow data on one or two interfaces for a period of time to understand the memory requirements of your installation. Add more interfaces to ensure that your database scales as needed. INSTALL SOLARWINDS NTA 1. Log in to the server on which you installed SolarWinds NPM. 2. Launch the installation file from the download location. 3. Review the Welcome information, and click Next. 4. Select the configuration SolarWinds NPM/NTA and SolarWinds NTA Flow Storage Database on Two Separate Servers, and click Next. 5. Enter the SolarWinds NTA Flow Storage Database server host name or IP address, and click Test Connection. 6. If you agree, accept the license agreement, and click Next. 7. Click Install. 8. When the installation completes, click Finish. If your license includes additional pollers or additional web consoles, see Install an additional poller and web console. CONFIGURE THE ORION SERVER AND DATABASE In the final step of the installation process, the system establishes a connection between the Orion application server (primary SolarWinds NPM and SolarWinds NTA server) and the Orion database, and configures the database and the application. The Configuration wizard configures the SolarWinds NTA module to interact with your underlying SolarWinds NPM database, NTA Flow Storage Database, website, and services. 1. If the Configuration wizard does not start automatically, start the Configuration wizard in the Orion Configuration and Auto-Discovery folder. 2. Review the Welcome text, and click Next. page 18

19 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER 3. Select SolarWinds NetFlow Traffic Analyzer Service in the Service Settings window, and click Next. 4. Specify a path to your SolarWinds NTA Flow Storage Database or click Browse to navigate to the location. The path should contain only ASCII characters. The defined folder should be located on a dedicated local NTFS drive, not on the system drive. 5. Enter an absolute path for storing your backups into the Backup NTA Flow Storage Database Data File Path field or click Browse to navigate to the location. 6. Click Next. 7. Review the configuration summary, and click Next. 8. Click Finish. After you complete the installation and configuration steps, Discovery for SolarWinds NTA, and Set up your flow environment. page 19

20 Evaluation installation This section contains the following topic: Install an evaluation copy of SolarWinds NTA page 20

21 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Install an evaluation copy of SolarWinds NTA The SolarWinds NTA evaluation version is a full version of the product, functional for 30 days. After the evaluation period, you can easily convert your evaluation license to a production license by obtaining and applying a license key. For evaluation installations only, you can install SolarWinds NTA Flow Storage Database and SolarWinds NTA on the same server. SolarWinds NTA checks your server configuration and informs you if it does not meet the minimum requirements. If you receive the warning, consider upgrading your server or deploying the SolarWinds NTA Flow Storage Database on a different computer. Installation on a desktop operating system is possible, but will significantly affect performance. SolarWinds recommends installing the evaluation version on a server operating system. SolarWinds NTA is intended for use in a production environment that meets the Multi-module system guidelines. EVALUATION AND PRODUCTION ENVIRONMENTS Windows Server 2008 R2 SP1 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 EVALUATION ENVIRONMENTS ONLY Windows 7 SP1 Windows 8 (except for Standard Edition) Windows 8.1 (except for Standard Edition) Windows 8.1 Update 1 (except for Standard Edition) Windows 8.1 Pro, and Windows 8.1 Enterprise (Pro or Enterprise version recommended) Windows 10 How to install an evaluation copy of SolarWinds NTA: 1. Download an evaluation version of SolarWinds NTA from This installation is functional for 30 days and for evaluation purposes only. No activation key is required. 2. Log in to the server as an administrator. 3. Run SolarWinds-NTA-<version>-Eval.exe. 4. If prompted, register your address. 5. Click Next on the Welcome window. 6. If you agree, accept the terms of the license agreement. 7. Select your preferred settings. page 21

22 8. Enable quality of experience (QoE) traffic monitoring. Enabling QoE installs an agent on the Orion Main Polling Engine. This agent collects packet-level traffic statistics, like network response time and application response time, for any application traffic it sees going to or from Orion. SolarWinds recommends that you enable QoE. 9. Review the list of software the system installs. Downloading and installing Microsoft.NET Framework 4.5 can take more than 20 minutes. If your system reboots, run the installation again. If you are using Microsoft Internet Explorer, SolarWinds recommends you add the URL of your Orion website ( the URL of SolarWinds support ( and about:blank to the list of trusted sites. 10. After the installation is complete, the system configures the product. Click Finish to open the Orion Web Console Login page. If the login page does not open automatically, launch the Orion Web Console in your SolarWinds Orion program folder. 11. Log in with user name admin and leave the password field blank. The Orion Web Console opens. For security purposes, SolarWinds recommends that you change the password to your admin account. page 22

23 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Populate SolarWinds NTA with devices This section contains the following topics: Discovery for SolarWinds NTA page 23

24 Discovery for SolarWinds NTA For NTA to analyze bandwidth usage on your devices, you need to discover those network devices and add them to SolarWinds NPM and NTA for monitoring. If you completed the Network Performance Monitor Getting Started Guide, you discovered routers and switches that you want to manage with NTA. There is no discovery specific to NTA. If you have not discovered these types of network devices, discover your network, add discovered devices to Orion, and then return to the NetFlow Traffic Analyzer Getting Started Guide. SolarWinds recommends that you begin by discovering a limited number of core routers and switches so that you can learn how to manage them with NTA. Then you can add more devices to scale your deployment. If you are unsure if you discovered any network devices, log in to NPM and click My Dashboards > Network > Network Summary. The All Nodes managed by NPM resource lists all network devices discovered and added to Orion for monitoring. page 24

25 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Set up your flow environment This section contains the following topics: What protocols does SolarWinds NTA support? Flow environment best practices Enable a device to send flow data to SolarWinds NTA page 25

26 What protocols does SolarWinds NTA support? SolarWinds NTA collects and monitors interface-level flow data, and helps you identify consumers of bandwidth. Flow data comes to SolarWinds NTA using one of many protocols. Selectively specifying monitored protocols can reduce the amount of NetFlow traffic that SolarWinds NTA processes, which improves performance. Specified protocols depend on the device type, as each device supports different types of protocols. Check your vendor's documentation to determine the correct protocols. Difference between sampled and non-sampled flow: Sampled flow: Collects less data and provides only a sample. This prevents the network from overloading. Non-sampled flow: Collects all data. SolarWinds NTA supports these flow-enabled devices: FLOW SUPPORTED VERSIONS SAMPLED FLOW SUPPORT NetFlow v1, v5 and v9 v5 and v9 NetFlow version 9 is configured the same as NetFlow version 5, but uses a predefined template that is exported in separate flows. Flexible NetFlow is based on NetFlow version 9, but the fields are defined during configuration. Some devices using IOS versions export flows without specifying that it is being sampled. SolarWinds NTA processes these flows as unsampled. NetFlow v9 must have an appropriate template with all required fields. sflow v2, v4, and v5 Supported J-Flow Supported Supported Some devices using JunOS versions export flows without specifying that it is being sampled. SolarWinds NTA processes these flows as unsampled. IPFIX Supports IPFIX generated by ESX 5.1 and later, for IPv4 traffic. Supported page 26

27 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER FLOW SUPPORTED VERSIONS SAMPLED FLOW SUPPORT NetStream v5 and v9 Supported NetFlow Lite Cisco Wireless Controller NetFlow Supported on the following devices: Cisco Catalyst 2960-X Cisco Catalyst 2960-XR Cisco Catalyst 3560-CX Cisco Catalyst 2960-CX Supported on the following devices with the ipv4_ client_app_flow_record template: Cisco 2504 WLC Cisco 5508 WLC Cisco 5520 WLC Cisco Flex 7510 WLC Cisco 8510 WLC Cisco 8540 WLC Cisco WiSM2 Supported Not supported page 27

28 Flow environment best practices This section provides recommendations for setting your flow environment. DETERMINE WHERE TO ENABLE FLOW SolarWinds NTA can capture and store vast amounts of flow data. To make the best use of SolarWinds NTA, use the following guidelines to make decisions about where to capture enabled flow data. Understand your network and identify the types of problems you want to solve by capturing flow data. If you are unsure of where to begin, enable flow data at the core layer, let SolarWinds NTA run for a period of time (for example, a week), and review the SolarWinds NTA resources in the SolarWinds Orion Web Console to determine if the data collected is sufficient. If you need more flow data, move to the distribution layer. Due to the proliferation of duplicate data, SolarWinds recommends that you do not enable flows at the access layer. If you want to monitor internal traffic and internet traffic, enable ingress and egress interfaces. To capture the entire network conversation, enable ingress and egress on the external interfaces of a single node, or enable ingress only on all interfaces on the node. BE MINDFUL OF DIRECTIONALITY AND DUPLICATION If your devices are configured to export NetFlow on both ingress and egress interfaces, you might see duplicate traffic in the Summary resources. Duplicate flows can occur in the following cases: You have both ip flow ingress and ip flow egress applied for all interfaces on a device. You have set ip flow ingress on some interfaces and ip flow egress on other interfaces. On your serial interfaces with subinterfaces, you have NetFlow export enabled on both the physical and logical interfaces. page 28

29 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER CALCULATE THE SIZE OF YOUR FLOW STORAGE DATABASE Maintaining the SolarWinds NTA Flow Storage Database requires setting a retention period that corresponds with the amount of data you need to keep and the free disk space available on your SolarWinds NTA Flow Storage Database disk. 1. Collect sample flow data for a week. 2. Click Settings > All Settings. 3. Under Product Specific Settings, click NTA Settings. 4. Scroll down to the Database Settings section. 5. Under NTA Flow Storage Database Settings, click Calculate. 6. Review the Average Received Flows per Second, Current Size, and Projected Size. SET THE RETENTION PERIOD Retention period specifies the time for which flow data are stored in the database until they expire and are permanently deleted. The default retention period is set to 30 days To optimize the retention period for your SolarWinds NTA Flow Storage Database, collect data for a few days, and calculate the size of your SolarWinds NTA Flow Storage Database. You should then have an idea of the volume of data your network produces with NetFlow enabled. Consider also the space taken up by the database, and then adjust the retention period accordingly. page 29

30 1. Click Settings > All Settings. 2. Under Product Specific Settings, click NTA Settings. 3. Scroll down to the Database Settings section. 4. Note the database Location: host name and whether the database is installed locally or remotely. The database Location is noted on the same page, under NTA Flow Storage Database Settings. 5. Click Calculate to review the size of your database. 6. In the Retention Period field, enter the number of days after which flow data is deleted. 7. In the Delete Expired Data list, select a frequency. 8. Click Save. page 30

31 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Enable a device to send flow data to SolarWinds NTA To communicate the traffic-related data about a device, the device must be configured to send, push, or export the data to SolarWinds NTA. If you do not configure your device to send data, the Orion Web Console does not populate with flow data. REQUIREMENTS Your interfaces must be discovered and added to the Orion database. The interface index number for an interface in the SolarWinds Orion database (interface table) must match the index number in the collected flow data. After it collects NetFlow traffic data, SolarWinds NTA analyzes device bandwidth usage in terms of source and destination endpoints of conversations reflected in traffic. It can take up to 5 minutes for data to populate in SolarWinds NTA. The image below provides an example of NetFlow-enabled nodes listed in SolarWinds NTA, with a recent time posted for collected flow. ENABLE A DEVICE TO SEND FLOW DATA For a specific example, see the article Enable NetFlow export on a Cisco model 2610 router. page 31

32 Identify consumers of interface bandwidth This section contains the following topics: Identify consumers of interface bandwidth Keep close track of bandwidth utilization page 32

33 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Identify consumers of interface bandwidth Many network performance issues are caused by high bandwidth utilization. You can address these situations proactively with SolarWinds NTA by modifying out-of-the-box alerts. The High Receive Percent Utilization with Top Talkers and High Transmit Percent Utilization with Top Talkers alerts trigger when the percent utilization of an interface rises above 75%. You can adjust the threshold value and configure the alert to send an to you. The following scenario assumes that bandwidth capacity is a concern of yours, and walks you through how to identify top talkers that are consuming bandwidth. The information in these examples help you determine if top consumers of interface bandwidth are using resources for business purposes (and therefore need to add capacity), or if you should block top talkers. For more information about alerts, see the NPM Getting Started Guide. You can also create your own alert on bandwidth utilization with custom trigger conditions and actions. For more information about creating customs alerts, see the NPM Administrator Guide. CHANGE THE THRESHOLD FOR TOP TALKER ALERTS The High Receive Percent Utilization with Top Talkers and High Transmit Percent Utilization with Top Talkers alerts are out-of-the-box and sent from SolarWinds NPM, which help you monitor the bandwidth utilization. For more information about alerts, see the NPM Getting Started Guide. The Top Talker alerts use a default utilization threshold of 75%. According to your internal business guidelines regarding bandwidth utilization, you want to be notified when bandwidth utilization exceeds 70%. When the utilization exceeds 70%, you can configure an notification. The following example shows you how to take the High Receive Percent Utilization with Top Talkers alert, and duplicate and edit it to change only the trigger condition. 1. Click Alerts & Activity > Alerts. 2. Click Manage Alerts. 3. In the Group By field, select Trigger Actions Type. page 33

34 4. In the Group By field, select a Web Page. 5. Select the High Receive Percent Utilization with Top Talkers alert. 6. Click Duplicate & Edit. 7. Under Enabled, turn the alert On and select how often the trigger condition should be checked. 8. On Trigger Condition, change the utilization percent to On Time of Day, schedule when to run the alert. page 34

35 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER 10. Complete the Trigger Actions and Reset Actions panels as necessary. If there are endpoint-centric resources on the Interface Details page when it is captured for a top talker alert notification, the links to those resources are non-functional in the . The information in the alert notification is not customizable. 11. Review the Summary, and click Submit. IDENTIFY TOP TALKERS WHEN THE INTERFACE BANDWIDTH UTILIZATION ALERT IS TRIGGERED This scenario assumes that you have created an Orion alert on bandwidth utilization for a specific interface, and that the alert has been triggered when interface bandwidth utilization reached 70%. You investigate the top talkers after this alert triggered. page 35

36 1. When you click the link in the alert , you are redirected to the NetFlow Interface Details for Alerts page in the Orion Web Console, and to the interface that triggered the alert. page 36

37 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER 2. Review the Top 5 Endpoints resource. You notice that endpoint 1e100.net (YouTube) is consuming a majority of your bandwidth. 3. In the Top 5 Endpoints resource, click on the endpoint to navigate to the details. 4. Review the Top 5 Conversations resource and identify the individuals that are consuming bandwidth. The following example shows a considerable amount of utilization on the Ethernet1 WAN (NetFlow) interface of the Internet Gateway 3725 node. page 37

38 page 38

39 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Keep close track of bandwidth utilization Use the Flow Navigator application to filter your SolarWinds NTA views and add them directly to the Views toolbar. While there are many ways to filter the data, this scenario assumes you have Identify consumers of interface bandwidth, and you want to create a filtered view that includes the interface, so that you can keep close track of bandwidth utilization. 1. From the NetFlow Interface Details page, click Flow Navigator. 2. In Time period, select Relative Time Period > 1 month. page 39

40 3. In Flow Direction, select Ingress. 4. In Advanced Applications, select youtube. page 40

41 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER 5. Click Submit. page 41

42 Plan for interface bandwidth capacity This section contains the following topics: Bandwidth capacity planning and analysis page 42

43 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Bandwidth capacity planning and analysis Use SolarWinds NTA to monitor interface-level network bandwidth and traffic patterns over the course of months, days, or minutes. SolarWinds NTA converts flow data into charts and tables that quantify exactly how a network is being used, by whom, and for what purpose. This can help you to: Find the source of bandwidth use by application, protocol, and IP address group. Analyze traffic patterns over months, days, or minutes by drilling down into any network element. Specify whether network slowness caused by high bandwidth utilization is business related or private. Define whether or not you need additional bandwidth. Customize and deliver detailed network traffic and bandwidth reports. GENERATE A WAN INTERFACES LAST 7 DAYS REPORT In SolarWinds NTA, flow data are stored in the NTA Flow Storage Database and CBQoS data are stored in the SolarWinds Orion database. Over time, both databases accumulate a large amount of information. SolarWinds offers a broad array of predefined reports, and the ability for you to create custom reports. For more information about reports, see the NPM Administrator Guide. The report Average and Peak Traffic Rates - WAN Interfaces Last 7 Days displays the average and peak traffic rates for each WAN interface over the last week. Using this report helps you monitor bandwidth utilization and plan for future capacity needs. page 43

44 1. Click Reports > All Reports. 2. Under Group By, select Report Category > Historical Traffic Reports. page 44

45 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER 3. Select Average and Peak Traffic Rates - WAN Interfaces Last 7 Days to display the report. The report provides the following values: Average receive bps. Peak receive bps. Average transmit bps. page 45

46 Peak transmit bps. MAC address. page 46

47 GETTING STARTED GUIDE: NETFLOW TRAFFIC ANALYZER Beyond getting started Congratulations on completing the SolarWinds NTA Getting Started Guide. To learn more about SolarWinds NTA, see these additional resources: If you need implementation help, contact our Support team. Read the SolarWinds Customer Support Information article to learn how to properly open a support case and get your case the right level of visibility. SolarWinds NTA Administrator Guide. SolarWinds NTA on THWACK. SolarWinds NTA Release Notes. page 47