HPE IMC NTA MPLS VPN Traffic Analysis Configuration Examples

Transcription

1 HPE IMC NTA MPLS VPN Traffic Analysis Configuration Examples Part number: Software version: IMC NTA 7.2 (E0401) The information in this document is subject to change without notice. Copyright 2016 Hewlett Packard Enterprise Development LP

2 Contents Introduction 1 Restrictions and guidelines 1 Example: Configuring IMC NTA to work with a NetStream device for MPLS VPN traffic analysis 1 Network configuration 1 Software versions used 2 Configuring NetStream on the HPE A-MSR30-40 router 2 Configuring NTA 2 Adding the NetStream device to NTA 2 Deploying the NTA configuration 4 Adding a VPN traffic analysis task 5 Verifying the configuration 7 Viewing the summary report of all VPN traffic analysis tasks 7 Viewing the report of an individual VPN traffic analysis task 7 Example: Configuring IMC NTA to work with a NetStream module for MPLS VPN traffic analysis 9 Network configuration 9 Software versions used 10 Configuring the S7503E switch 10 Configuring local port mirroring on the S7503E switch 10 Configuring the NetStream module 10 Configuring IMC NTA 11 Verifying the configuration 11 i

3 Introduction This document provides examples for using NetStream and IMC NTA to analyze MPLS VPN traffic. Restrictions and guidelines When you configure NetStream and IMC NTA, follow these restrictions and guidelines: Make sure the device can export NetStream data in version 9 format. Make sure the device and IMC NTA server can reach each other. Example: Configuring IMC NTA to work with a NetStream device for MPLS VPN traffic analysis Network configuration As shown in Figure 1, enable NetStream on GigabitEthernet 0/0 on the HPE A-MSR30-40 router (Hub-PE) with the management IP address /24. To use IMC NTA to analyze MPLS VPN traffic passing through the router, perform the following tasks: Configure the router to export MPLS-aware NetStream data to IMC NTA. Configure IMC NTA to receive NetStream data and generate reports based on the data. Figure 1 Network diagram 1

4 Software versions used This configuration example was created and verified on HPE A-MSR30-40, Comware Software Version , Release 2509, Standard. Configuring NetStream on the HPE A-MSR30-40 router # Specify the IP address and listening port of IMC NTA as the destination host for NetStream data export. You can also specify UDP port 9021 or 6343 as the listening port. <Sysname>system-view [Sysname]ip netstream export host # Configure the router to export NetStream data in version 9 format. [Sysname]ip netstream export version 9 # Configure the router to refresh NetStream version 9 templates at the interval of 1 minute. [Sysname]ip netstream export v9-template refresh-rate time 1 # Configure NetStream to collect statistics for MPLS packets. [Sysname]ip netstream mpls # Enable NetStream for incoming and outgoing traffic on GigabitEthernet 0/0. [Sysname]interface GigabitEthernet 0/0 [Sysname-GigabitEthernet0/0]ip netstream inbound [Sysname-GigabitEthernet0/0]ip netstream outbound [Sysname-GigabitEthernet0/0]quit Configuring NTA The IMC NTA configuration procedures are the same for VPN traffic analysis tasks. Adding the NetStream device to NTA 1. Click the Service tab. 2. From the navigation tree, select Traffic Analysis and Audit > Settings. The Settings page opens, as shown in Figure 2. 2

5 Figure 2 Accessing the Settings page 3. In the Guide to Quick Traffic Analysis And Audit Configuration area, click Device Management. 4. In the Device List area, click Add. The Add Device page opens. 5. Configure the NetStream device parameters, as shown in Figure 3: a. In the Device IP field, enter the IP address of the device or click Select to select the device from the IMC platform. If you select a device from the platform, the following fields are automatically populated: Name, SNMP Community, and SNMP Port. b. Specify the SNMP community and port number. Make sure the settings are the same as those on the device. c. Enter the IP address of the interface that sends the logs to NTA in the Log Source IP field. This step is required if the device does not support SNMP. d. Select Valid from the NetStream Statistics Identifier list. e. Select Enable from the NetStream New Feature list. This item sets whether to enable the NetStream sampling feature on the device. f. Use the default values for other parameters. 3

6 Figure 3 Adding the NetStream device to NTA 6. Click OK. Deploying the NTA configuration 1. In the Guide to Quick Traffic Analysis And Audit Configuration area, click Server Management. The Server Management page opens, as shown in Figure 4. Figure 4 Viewing the NTA server 2. Click the Modify icon for the server with the name The Server Configuration page opens. 3. Modify the server parameters as needed, as shown in Figure 5: a. In the Device Information area, select the device named Hub-PE. b. Use the default values for other parameters. 4

7 Figure 5 Modifying the server configuration 4. Click Deploy. Adding a VPN traffic analysis task 1. In the Guide to Quick Traffic Analysis And Audit Configuration area, click Traffic Analysis Task Management. The Traffic Analysis Task Management page opens. 2. In the Traffic Analysis Task List area, click Add. The Select Task Type page opens. 3. Select VPN and click Next. The Add Traffic Analysis Task page opens. 4. Configure traffic analysis task parameters, as shown in Figure 6: a. Enter VPN in the Task Name field. b. Select from the Server list. c. Click Select next to the Reader field, select the groups that have permissions to view the task and reports generated by the task, and then click OK. d. Select Enable from the Baseline Analysis list. 5

8 Figure 6 Adding a VPN traffic analysis task 5. In the VPN Instance List area, click Add. The Set VPN Instance page opens. 6. Configure the VPN instance parameters, as shown in Figure 7: a. Select Hub-PE( ) from the Device Name list. b. Enter 1 in the VPN ID field. The VPN ID must be the same as that on the device. You can use the display ip vpn-instance command on the HPE A-MSR30-40 router to display the VPN instance information. The command for displaying the VPN instance information varies by device model. For information about the command used on a device, see the device command reference. c. Click OK. Figure 7 Configuring the VPN instance 6

9 7. On the Add Traffic Analysis Task page, click OK. Verifying the configuration NTA enables you to view the summary report of all VPN traffic analysis tasks and the report of an individual VPN traffic analysis task. Viewing the summary report of all VPN traffic analysis tasks 1. Click the Service tab. 2. From the navigation tree, select Traffic Analysis and Audit > VPN Traffic Analysis Task. The VPN Traffic page displays the summary report of all VPN traffic analysis tasks, as shown in Figure 8. Figure 8 Viewing summary information about VPN traffic analysis tasks Viewing the report of an individual VPN traffic analysis task 1. Click the Service tab. 2. From the navigation tree, select Traffic Analysis and Audit > VPN Traffic Analysis Task. The VPN Traffic page opens. 3. In the Summary List (Last 1 Hour) area, click VPN in the Task Name column. 7

10 The Traffic tab page opens by default. It displays traffic statistics for the task, as shown in Figure 9. Figure 9 Viewing traffic information for the VPN traffic analysis task 4. Click the Application tab. This tab page displays application traffic statistics and trend reports for the task VPN, as shown in Figure 10. Figure 10 Viewing application traffic information for the VPN traffic analysis task 8

11 5. Click the Session tab. This tab page displays the statistics and pie charts for the top 10 sessions of the task VPN, as shown in Figure 11. Figure 11 Viewing session information for the VPN traffic analysis task Example: Configuring IMC NTA to work with a NetStream module for MPLS VPN traffic analysis Network configuration As shown in Figure 12, the H3C S7503E core switch (Hub-PE) connects to an external network through GigabitEthernet 2/0/2. A NetStream module is installed on the switch. Ten-GigabitEthernet 0/1 of the NetStream module is connected to Ten-GigabitEthernet 2/0/1 of the switch. To use IMC NTA to analyze MPLS VPN traffic passing through the switch, perform the following tasks: Configure local port mirroring on the switch. Port mirroring copies the VPN traffic to the NetStream module. Configure the NetStream module to export MPLS-aware NetStream data to IMC NTA. Configure IMC NTA to receive NetStream data and generate reports based on the data. 9

12 Figure 12 Network diagram Software versions used This configuration example was created and verified on the following platforms: H3C S7503E, Comware Software Version 5.20, Release 6708P08 H3C SecBlade NetStream module, Comware Software Version 5.20, Release 3109P03 Configuring the S7503E switch Configuring local port mirroring on the S7503E switch # Create local mirroring group 1. <S7503E>system-view [S7503E]mirroring-group 1 local # Configure mirroring group 1 to monitor the incoming and outgoing traffic on GigabitEthernet 2/0/2. [S7503E]mirroring-group 1 mirroring-port GigabitEthernet2/0/2 both # Configure Ten-GigabitEthernet 2/0/1 as the monitor port of mirroring group 1. [S7503E]mirroring-group 1 monitor-port Ten-GigabitEthernet 2/0/1 Configuring the NetStream module # Enable NetStream for incoming traffic on Ten-GigabitEthernet 0/1. [NS]system-view [NS]interface Ten-GigabitEthernet0/1 10

13 [NS-Ten-GigabitEthernet0/1]ip netstream inbound [NS-Ten-GigabitEthernet0/1]quit # Specify the export destination host as with UDP port (The UDP port can also be 9021 or 6343.) [NS]ip netstream export host # Configure the NetStream module to export NetStream data in version 9 format. [NS]ip netstream export version 9 # Configure the NetStream module to refresh NetStream version 9 templates at the interval of 1 minute. [NS]ip netstream export v9-template refresh-rate time 1 # Configure NetStream to collect statistics for MPLS packets. [NS]ip netstream mpls Configuring IMC NTA For information about the configuration procedures, see "Configuring NTA." NOTE: If a NetStream module is used, add the module to NTA by specifying its management IP address. Verifying the configuration For information about the configuration procedures, see "Verifying the configuration." 11