Brocade 5600 IPFIX Configuration

SHARE

I’m sure most of you have heard about Brocades recent acquisition of Vyatta, a software-based virtual application provider. But that’s not all they have done. Not long after they released a new version of Vyattas 5600 vRouter: the Brocade 5600 vRouter.

The cool thing about the vRouter is it supports IPFIX, a network protocol that strips off packet headers and sends them off to a flow collector. Using a flow collector like Scrutinizer, you can gain unmatched visibility into the traffic that traverses your network.

I have included the link for the commands, but I decided I’d help out by walking you through the commands needed to enable IPFIX on your virtual router!

Brocade Configuration

Step 1) Create a flow-monitoring exporter and specify the IP address and UDP port of the NetFlow collector.

[email protected]# set service flow-monitoring exporter foo udp-collector address 10.10.1.2
[email protected]# set service flow-monitoring exporter foo udp-collector port 9995

Step 2) Create a packet selector named foo and specify a sampling size of 10 packets. The sampling rate in this case is 1:10, which means that the router will randomly select one packet from every 10 packets that flow through any data plane interface with which the selector is associated.

[email protected]# set service flow-monitoring selector foo randomly out-of 10

Step 3) Create a packet aggregator named “foo” and specify an expiration time of 1,800 seconds for active flows and 15 seconds for inactive flows.

[email protected]# set service flow-monitoring aggregator foo expiration inactive-timeout 15
[email protected]# set service flow-monitoring aggregator foo expiration active-timeout 1800

Step 4) Connect the aggregator to the exporter

[email protected]# set service flow-monitoring aggregator foo next exporter foo

Step 5) Now configure the aggregation rule for the foo aggregator-

[email protected]# set service flow-monitoring aggregator foo key destinationIPv4Address
[email protected]# set service flow-monitoring aggregator foo key destinationTransportPort
[email protected]# set service flow-monitoring aggregator foo key ipClassOfService
[email protected]# set service flow-monitoring aggregator foo key protocolIdentifier
[email protected]# set service flow-monitoring aggregator foo key sourceIPv4Address
[email protected]# set service flow-monitoring aggregator foo key sourceTransportPort
[email protected]# set service flow-monitoring aggregator foo non-key bgpDestinationAsNumber
[email protected]# set service flow-monitoring aggregator foo non-key bgpSourceAsNumber
[email protected]# set service flow-monitoring aggregator foo non-key destinationIPv4PrefixLength
[email protected]# set service flow-monitoring aggregator foo non-key egressInterface
[email protected]# set service flow-monitoring aggregator foo non-key flowEndMilliseconds
[email protected]# set service flow-monitoring aggregator foo non-key flowStartMilliseconds
[email protected]# set service flow-monitoring aggregator foo non-key ipNextHopIPv4Address
[email protected]# set service flow-monitoring aggregator foo non-key octetDeltaCount
[email protected]# set service flow-monitoring aggregator foo non-key packetDeltaCount
[email protected]# set service flow-monitoring aggregator foo non-key sourceIPv4PrefixLength
[email protected]# set service flow-monitoring aggregator foo non-key tcpControlBits

Step 6) Next you are going to apply the foo selector and foo aggregator to the dp0p1s1 data plane interface-

[email protected]# set interfaces dataplane dp0p1s1 flow-monitoring selector foo
[email protected]# set interfaces dataplane dp0p1s1 flow-monitoring aggregator foo

Step 7) Commit the configuration, and then save it-

[email protected]# commit
[email protected]# save

Step 8) Verify that everything looks good before you exit the configuration. Hopefully it looks similar to this-

[email protected]# show interfaces
interfaces {
   dataplane dp0p1s1 {
     address 10.10.1.1/24
     flow-monitoring {
          aggregator foo
          selector foo
            }
          }
       }       

[email protected]# show services
service {
  flow-monitoring {
       exporter foo {
         udp-collector {
           address 10.10.1.2
           port 9995
                       }
                    }
            selector foo {
                 randomly {
                   out-of 10
                          }
                       }
             aggregator foo {
                 aggregator statistics: {
                    flows in cache: 18
                    expired flows: 180
                    expiration {
                       active-timeout 1800
                       inactive-timeout 15
                               }
                        next {
                                exporter foo
                             }
                        rule {
                           key destinationIPv4Address
                           key destinationTransportPort
                           key ingressInterface
                           key ipClassOfService
                           key protocolIdentifier
                           key sourceIPv4Address
                           key sourceTransportPort
                           non-key bgpDestinationAsNumber
                           non-key bgpSourceAsNumber
                           non-key destinationIPv4PrefixLength
                           non-key egressInterface
                           non-key flowEndMilliseconds
                           non-key flowStartMilliseconds
                           non-key ipNextHopIPv4Address
                           non-key octetDeltaCount
                           non-key packetDeltaCount
                           non-key sourceIPv4PrefixLength
                           non-key tcpControlBits    
                              }
                      }
             }

Step 9) Exit the configuration and check your exporter statistics-

[email protected]# exit
[email protected]:~$ show flow-monitoring
dataplane statistics:
    interface dp0p1s1:
        monitor default:
            packets observed:            884
            samples taken:                88
export daemon statistics:
  /exporter/default:
    /monitor/mon1/ipv4:
      reports received:                   88
      reports exported:                   88
    /monitor/mon1/ipv6:
      reports received:                    0
      reports exported:                    0

Step 10) Get up, stretch your legs, you’re done!

Now that you’ve successfully configured your vRouter for IPFIX exports, you’re going to need a NetFlow/IPFIX analyzer. Scrutinizer can give you unparalleled visibility into your Flow data. Don’t believe me? Take advantage of the fully supported trial version of Scrutinizer, and see for yourself what kind of visibility you’ll get!

Related

Deep Network Observability

What is Deep Network Observability?

Network Observability is the ability to collect, analyze, and activate network data. With network observability, you can easily answer questions about your network. Deep Network

Read More