Table of Contents
Advertisement
This document describes the NetFlow feature and its configuration on Enterasys switch/routers.
For information about...
What Is NetFlow?
NetFlow is a flow-based data collection protocol that provides information about the packet flows
being sent over a network. NetFlow collects data by identifying unidirectional IP packet flows
between a single source IP address/port and a single destination IP address/port, using the same
Layer 3 protocol and values found in a fixed set of IP packet fields for each flow. NetFlow collects
identified flows and exports them to a NetFlow collector. A NetFlow management application
retrieves the data from the collector for analysis and report generation.
Why Would I Use It in My Network?
Standard system feedback is simply not granular enough to provide for such network
requirements as planning, user or application monitoring, security analysis, and data mining. For
example, because of its ability to identify and capture network flows, NetFlow:
•
Provides a means to profile all flows on your network over a period of time. A network profile
provides the granularity of insight into your network necessary for such secure network
functionality as establishing roles with policy and applying QoS to policy.
•
Provides a means of isolating the source of DoS attacks allowing you to quickly respond with
a policy, ACL, QoS change, or all of these to defeat the attack.
•
Can identify the cause of an intermittently sluggish network. Knowing the cause allows you to
determine whether it is an unexpected, but legitimate, network usage that might be
rescheduled for low usage time blocks, or maybe an illegitimate usage of the network that can
be addressed by speaking to the user.
NetFlow Configuration
Refer to page...
1
1
2
3
6
10
13
14
15
Advertisement
Table of Contents
Related Manuals for Enterasys Matrix N1
Summary of Contents for Enterasys Matrix N1
-
Page 1: Table Of Contents
What Is NetFlow? Why Would I Use It in My Network? How Can I Implement NetFlow? Understanding Flows Configuring NetFlow on the Enterasys Matrix DFE Configuring NetFlow on the Matrix X Core Router Terms and Definitions NetFlow Version 5 Record Format... -
Page 2: How Can I Implement Netflow
How Can I Implement NetFlow? • Can look into the flows that transit the network links, providing a means of verifying whether QoS and policy configurations are appropriately configured for your network. • Can understand your network’s flow characteristics, allowing for better planning when transitioning to new applications or services. How Can I Implement NetFlow? Having a profile of captured flows that transit your network over time is a crucial first step in implementing a secure network. This NetFlow profile provides you with a good understanding of the actual group and individual behaviors that make up the roles you set by policy and to which you apply QoS. A profile can also be very helpful in situations, such as projecting how a network might react to the introduction of a new application prior to actual implementation. Figure 1 illustrates an example of a NetFlow network profile setup. Figure 1 NetFlow Network Profile Example To complete a NetFlow network profile, enable NetFlow on all ports where packet flows aggregate. At the top of Figure records that are captured at each NetFlow‐enabled port. These flow records will be retained February 26, 2008 1 you will find an abbreviated sample of the independent flow Page 2 of 19... -
Page 3: Understanding Flows
Understanding Flows The concept of a flow is critical to understanding NetFlow. A flow is a stream of IP packets in which the value of a fixed set of IP packet fields is the same for each packet in the stream. A flow is identified by seven key fields in an IP packet: • Source input interface • Source IP address • Destination IP address • Destination port (UDP/TCP port number) • Source port (UDP/TCP port number) • IP TOS field • Layer 3 protocol Each packet containing the same value for all of these fields is considered part of the same flow, until flow expiration occurs. If a packet is viewed with any key field value that is different from any current flow, a new flow is started based upon the key field values for that packet. The NetFlow protocol will track a flow until an expiration criteria has been met, up to a configured number of current flows. Each flow has different data, based on the NetFlow export version format supported by the network device. This data can include such items as packet count, byte count, destination interface index, start and end time, and next hop router. Flow Expiration Criteria Flows are not exported by the network switch to the NetFlow collector until expiration takes place. There are two timers that affect flow expiration: the NetFlow active and inactive timers. February 26, 2008 Page 3 of 19... - Page 4 Understanding Flows The active timer determines the maximum amount of time a long lasting flow will remain active before expiring. When a long lasting active flow expires, due to the active timer expiring, another flow is immediately created to continue the ongoing flow. It is the responsibility of the management application, on the NetFlow collector, to rejoin these multiple flows that make up a single logical flow. The active timer is configurable in the CLI (see Configuring the Active Flow Export Timer on page 6). The inactive timer determines the length of time NetFlow waits before expiring the flow once a flow has stopped. The inactive timer is a fixed value of 40 seconds and cannot be configured. Rules for expiring NetFlow cache entries include: • Flows which have been idle for 40 seconds (fixed value in firmware) are expired and removed from the cache. • Long lived flows are expired and removed from the cache. (Flows are not allowed to live more than 30 minutes by default; the underlying packet conversation remains undisturbed). • Flows associated with an interface that has gone down are automatically expired. Figure 2 provides a graphic depiction of how these timers interact. Flows 1 and 3 show a single long lasting logical flow. Flow 1 times out and expires at 30 minutes, the active timer length. Because the flow expires, an export packet is sent to the NetFlow collector. Flow 3 continues this long lasting flow for another 10 minutes. At time 40 minutes the flow ends. The 40 second inactive timer initiates and expires at 40 minutes and 40 seconds resulting in an export packet to the NetFlow collector for flow 3. At the NetFlow collector, the management application joins the two flows into a single logical flow for purposes of analysis and reporting. Flow 2 is a 7.5‐minute flow that never expires the active timer. It begins at 2.5 minutes and ends at 10 minutes. At 10 minutes the inactive timer commences and expires the flow at 10 minutes and 40 seconds. At this time, NetFlow sends an export packet for the flow to the NetFlow collector for processing. February 26, 2008 Page 4 of 19...
- Page 5 Understanding Flows Figure 2 Flow Expiration Timers Deriving Information from Collected Flows On the collection server, a third‐party NetFlow collector application correlates the received records and prepares them for use by the NetFlow management application. (In some cases the collector and managment applications are bundled in a single application.) The management application retrieves the flow records, combines flows that were broken up due to expiration rules, and aggregates flows based upon common values, before processing the data into useful reports viewable by the network administrator. Correlated reports can be the basis for such information categories as: • Understanding who is originating and receiving the traffic • Characterizing the applications that are utilizing the traffic • Examining flows by priority • Characterizing traffic utilization by device • Examining the amount of traffic per port February 26, 2008 Page 5 of 19...
-
Page 6: Configuring Netflow On The Enterasys Matrix Dfe
Configuring NetFlow on the Enterasys Matrix DFE Configuring NetFlow on the Enterasys Matrix DFE The Matrix N‐Series DFEs (Gold, Platinum, and Diamond) all support NetFlow. NetFlow is disabled by default on all devices at device startup. This section covers the following NetFlow configuration topics: • Enterasys Matrix DFE Implementation • Configuring the Active Flow Export Timer • Configuring the NetFlow Collector IP Address • Configuring the NetFlow Export Version • Configuring NetFlow Export Version Refresh • Configuring a NetFlow Port • Configuring the NetFlow Cache • Displaying NetFlow Configuration and Statistics Enterasys Matrix DFE Implementation The Matrix DFE flow‐based architecture provides a powerful mechanism for collecting network flow statistics, with reporting capacity that scales with the addition of each DFE module. For each flow, packet and byte count statistics are collected by the DFE forwarding hardware. The flow ... - Page 7 Configuring NetFlow on the Enterasys Matrix DFE responsibility of the management application to recognize the multiple flows as a single logical flow for analysis and reporting purposes. The active flow timer defaults to 30 minutes. Notes: Some NetFlow management applications expect to see export packets prior to some set interval that is often as low as 1 minute. Check the documentation for your management application and make sure that the active flow timer is configured for a value that does not exceed that value.
- Page 8 Configuring NetFlow on the Enterasys Matrix DFE system must be determined, since the default settings of a 20‐packet refresh rate and a 30‐minute timeout may not be optimal for your environment. See Configuring NetFlow Export Version Refresh. NetFlow Version 9 records generated by DFE modules use true MIB‐2 ifIndex values since the template mechanism permits transmission of 4‐byte ifIndexes. Version 9 also uses 8‐byte packet and byte counters, so they are less likely to roll over. Check with your collector provider to determine if they provide the necessary support. The current Version 9 implementation: • Does not support aggregation caches. • Provides four predefined templates. The appropriate template is selected for each flow depending on whether the flow is routed or switched, and whether it is a TCP/UDP packet or not. See Table 9 supported templates. Use the set netflow export‐version {5|9} command to set the NetFlow export version. Use the clear netflow export‐version command to reset the export version to the default value. Configuring NetFlow Export Version Refresh Version 9 template records have a limited lifetime and must be periodically refreshed. Templates are retransmitted when either • the packet refresh rate is reached, or • the template timeout is reached. Template refresh based on the timeout period is performed on every module. Since each DFE module handles its own packet transmissions, template refresh based on number of export packets sent is managed by each module independently. The refresh rate defines the maximum delay a new or restarted NetFlow collector would experience, before it learns the format of the data records being forwarded (from the template ...
- Page 9 Configuring NetFlow on the Enterasys Matrix DFE Configuring a NetFlow Port NetFlow records are only collected on ports that are enabled for NetFlow. Use the set netflow port port‐string enable command to enable NetFlow on the specified ports. Use the set netflow port port‐string disable command to disable NetFlow on the specified ports. Use the clear netflow port port‐string command to set the port to the default value of disabled. Configuring the NetFlow Cache Enabling the NetFlow Cache globally enables NetFlow on all DFE modules for this system. When NetFlow recognizes a new flow on the ingress port, it creates a NetFlow record for that flow. The NetFlow record resides in the NetFlow cache for that port until an expiration event is triggered for that flow, at which time it is sent along with other expired flows in an export packet to the NetFlow collector for processing. Use the set netflow cache enable command to enable NetFlow on this system. Use the set netflow cache disable command to globally disable NetFlow on this system. Use the clear netflow cache command to reset the NetFlow cache to the default value of disabled for this DFE module. Displaying NetFlow Configuration and Statistics Use the show netflow command to display the current configuration and export statistics for this system. Use the show netflow config port‐string command to display the NetFlow configuration for a single or set of ports. Use the show netflow statistics export command to display export statistics for this system. Procedure 1 provides a CLI example of a NetFlow setup. Steps 1 – 3 are required. Steps 4 – 6 are ...
-
Page 10: Configuring Netflow On The Matrix X Core Router
Configuring NetFlow on the Matrix X Core Router Procedure 1 Configuring NetFlow on Matrix N-Series Systems (continued) Step Task If using version 9, optionally modify the number of export packets sent that cause a template to be retransmitted by an individual DFE module and/or the length of the timeout period, in minutes, after which a template is retransmitted by all modules in the system. - Page 11 Configuring NetFlow on the Matrix X Core Router data to the CM for export when the configured export‐interval time expires (default is 30 minutes) or when the cache is full. The NetFlow export process on the CM gathers any further data needed to complete the data record format for the configured NetFlow version and sends the flow records to the configured NetFlow collector. Note that only one NetFlow export destination (collector) can be configured per X Router system. NetFlow can be enabled on any port on the X Router. The Matrix X Router currently supports data export Version 1 and Version 5. CLI commands are provided to configure certain record format values required for Version 5, such as engine ID and engine type. You must configure a NetFlow export destination before you can enable NetFlow globally or on any ports. NetFlow will start sampling packets after you enable NetFlow globally and on the desired ports. Procedure 2 Configuring NetFlow on Matrix X Core Router Systems Step Task Optionally, check the current NetFlow configuration settings and sampling rate.
- Page 12 Configuring NetFlow on the Matrix X Core Router clear netflow port port-string When you disable NetFlow on a port, NetFlow will stop sampling and the current flow data will be exported when the export time out interval expires. To disable NetFlow globally, use either of the following commands: set netflow cache disable clear netflow all When you execute the clear netflow all command, all NetFlow settings are returned to their default condition. In the case of the global NetFlow cache setting, the default is disabled. Displaying NetFlow Information To display the current NetFlow configuration settings: show netflow config To display NetFlow statistics on a per‐port basis: show netflow statistics port-string To display flow counters for the current cached NetFlow information, on a system‐wide or IOM‐specific basis: show netflow cache-flow [slot-id] Default NetFlow Settings for the Matrix X Core Router Table 2 provides a listing of the default NetFlow settings for the Matrix X Core Router.
-
Page 13: Terms And Definitions
Contains the flow records for all currently active flows. A location where a condensed and detailed history of flow information that entered each NetFlow-enabled switch or router is archived for use by the NetFlow management application. A transport mechanism that periodically (based upon a timer or the number of flows accumulated in the cache) sends NetFlow data from the cache to a NetFlow collector for data analysis. -
Page 14: Netflow Version 5 Record Format
NetFlow Version 5 Record Format NetFlow Version 5 Record Format Table 4 provides a listing and description for the NetFlow version 5 header fields and data record format. The contents of these data fields are used by the collector software application for flow analysis. Data fields are identified in the data record packet sent by the network switch to the collector. The data records contain the values specified by the format. Table 4 NetFlow Version 5 Template Header and Data Field Support NetFlow Version 5 Header Data Field count sys_uptime unix_secs unix_nsecs flow_sequence engine_type engine_id sampling_interval... -
Page 15: Netflow Version 9 Templates
Flow Record Count Sys Up Time Unix Seconds Flow Sequence Counter Source ID NetFlow Version 9 Data Record (Template 256, Switch ID) Data Field February 26, 2008 IP protocol type (for example, TCP = 6; UDP = 17). IP type of service (ToS). - Page 16 Byte Count Start Time Last Time IP Protocol Next Hop Router V9 NetFlow Data Record (Template 258, Switch ID with TCP/UDP) Data Field February 26, 2008 (Destination) IP address of the destination device. MIBII 32-bit ID of the interface on which the packet was transmitted.
- Page 17 NetFlow Version 9 Templates Table 5 NetFlow Version 9 Template Header and Data Field Support (continued) Dest IfIndex Source IfIndex Packet Count Byte Count Start Time Last Time IP Protocol L4 Source Port L4 Dest Port V9 NetFlow Data Record (Template 259, Next Hop ID with TCP/UDP) Data Field Dest IfIndex Source IfIndex...
- Page 18 NetFlow Version 9 Templates Table 5 NetFlow Version 9 Template Header and Data Field Support (continued) L4 Source Port L4 Dest Port February 26, 2008 TCP/UDP source port nunmber (for example, FTP, Telnet, or equivalent) TCP/UDP destination port nunmber (for example, FTP, Telnet, or equivalent) Page 18 of 19...
-
Page 19: February 26, 2008
January 16, 2008 February 26, 2008 Enterasys Networks reserves the right to make changes in specifications and other information contained in this document and its web site without prior notice. The reader should in all cases consult Enterasys Networks to determine whether any such changes have been made. The hardware, firmware, or software described in this document is subject to change without notice. IN NO EVENT SHALL ENTERASYS NETWORKS BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS DOCUMENT, WEB SITE, OR THE INFORMATION CONTAINED IN THEM, EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED OF, KNEW OF, OR SHOULD HAVE KNOWN OF, THE POSSIBILITY OF SUCH DAMAGES. Enterasys Networks, Inc. 50 Minuteman Road Andover, MA 01810 © 2008 Enterasys Networks, Inc. All rights reserved. ENTERASYS, ENTERASYS NETWORKS, ENTERASYS MATRIX, ENTERASYS NETSIGHT, LANVIEW, WEBVIEW, and any logos associated therewith, are trademarks or registered trademarks of Enterasys Networks, Inc., in the United States and other countries. All other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies. Revision History Description First Release.