Flowops19th NetFlow Generation Appliance Catalyst 3850 Flexible NetFlow 2013.10.25 Kazumasa Ikuta kikuta@cisco.com © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 1 • UCS C220 M3サーバをベースに、フロー生成ソフトウェアを搭載した専用製品 4*10G Monitoring Interfaces 2 Intel Xeon E5-2680 processor 48 GB DDR3 memory (6*8GB) • NetFlow v5, v9, IPFIX • レイヤ2、IPv4、IPv6に対応したフローレコード(FNF互換) • シャーシ全体で、80,000,000フローキャッシュ、200,000フローエクスポート/秒 • 出力時のロードバランスまたはフローレプリケーション • 最大6つのコレクタ • 設定用に組込みGUIまたはCLIを利用 • 監視用GUIは搭載なし、別途コレクタが必要 • サンプリングはサポート無し(1:1)、オプションでレコード集約フィルタを適用 • Nexus7K, 5K, 3KまたはCat6Kを併用(SPAN元・NGAに管理デバイスとして一台登録)することで、各種情報 (Input/Output情報など)をNGAが補完して出力 © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 2 Supports up to six collectors (Management Application) Third-party NetFlow Collector Cisco Infrastructure 10 export filters per destination Other Management Applications Exports Netflow . . . V5, V9, IPFIX records Two Deployment Modes • Flow Replication • Load Balanced Mgmt – 1 Gbps Cisco NGA 4x10Gbps Monitoring ports 10 Gbps 10 Gbps 10 Gbps 10 Gbps SPAN or network TAP L2, IPv4 and IPv6 traffic support © 2013 Cisco and/or its affiliates. All rights reserved. Nexus 7K Cat 6500 TAP Trunk Link Cisco Public 3 Reporting Application Reporting Application NGA NGA 10Gb 10Gb 10Gb Network TAP 10Gb SPAN SPAN 2x10Gb 2x10Gb SPAN Nexus 5000 Nexus 7000 SPAN SPAN Nexus 5000 • SPAN aggregated at Network TAP • SPAN traffic from TAP sent to NGA’s four 10Gb Data Ports © 2013 Cisco and/or its affiliates. All rights reserved. Nexus 5000 Nexus 2000 SPAN two individual 10Gb link or portchannel from each N5K Cisco Public 4 あらかじめ作成したExporter と Record を、モニターに関連付け、Activate © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 5 フロー識別キー © 2013 Cisco and/or its affiliates. All rights reserved. フローごとに収集 Cisco Public 6 フローレコードの定義 © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 7 1 Exporterあたり、最大6つの コレクタを設定可能 出力を、ロードバランスまたは レプリケーション © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 NDEサンプル(Rec-1) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 9 http://www.cisco.com/web/JP/product/hs/switches/cat3850/prodlit/data_sheet_c78-720918.html © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 10 • Catalyst 3850 • IOS XE3.3 (2013/10/7に公開) • 有線スイッチに無線コントローラを統合 • 有線全ポートでFlexible NetFlow • 無線コントローラでFlexible NetFlow、 NBAR(DPI) • ASIC処理なのでラインレート WLAN端末トラフィックを対象 とするNetFlow(FNF) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 flow record W-Rec-1 description See-Cisco.com-Manual match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match flow direction match application name match wireless ssid collect counter bytes long collect counter packets long collect wireless ap mac address collect wireless client mac address C3850-01#sh run int gi 1/0/1 ! interface GigabitEthernet1/0/1 switchport mode trunk ip flow monitor Mon-1 input ip flow monitor Mon-1 output C3850-01#sh run | sec wlan wlan NMS 1 NMS client vlan AP-test ip dhcp server 10.71.154.54 ip flow monitor W-Mon-1 input ip flow monitor W-Mon-1 output no security wpa no security wpa akm dot1x no security wpa wpa2 no security wpa wpa2 ciphers aes no shutdown © 2013 Cisco and/or its affiliates. All rights reserved. 無線AP配下のトラフィックを対象とするFlexible NetFlow設定例 – Catalyst 3850 ! flow exporter kikuta-dhcp description kikuta-dhcp destination 10.141.43.88 transport udp 2055 template data timeout 120 option usermac-table timeout 120 option sampler-table timeout 120 option application-table timeout 120 ! flow exporter PI20_88-second description PI20_88-second destination 10.71.154.88 source Vlan55 transport udp 9991 template data timeout 60 option usermac-table option interface-table timeout 60 ! flow monitor W-Mon-1 exporter kikuta-dhcp exporter PI20_88-second cache timeout inactive 60 cache timeout active 120 record W-Rec-1 ! 物理IFに対して flow monitor を適用 Wlan配下に対して flow monitorを適用 Cisco Public 12 ※ラボ環境でのテストトラフィックです © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 13 送信テンプレート例 Flow Exporter kikuta-dhcp: Client: Option options application-name Exporter Format: NetFlow Version 9 Template ID : 256 Source ID : 1 Record Size : 87 Template layout _____________________________________________________________________ | Field | Type | Offset | Size | --------------------------------------------------------------------| v9-scope system | 1 | 0 | 4 | | application id | 95 | 4 | 4 | | application name | 96 | 8 | 24 | | application description | 94 | 32 | 55 | --------------------------------------------------------------------Client: Option options usermac Exporter Format: NetFlow Version 9 Template ID : 257 Source ID : 1 Record Size : 266 Template layout _____________________________________________________________________ | Field | Type | Offset | Size | --------------------------------------------------------------------| v9-scope system | 1 | 0 | 4 | | wireless client mac address | 365 | 4 | 6 | | flow username | 371 | 10 | 256 | --------------------------------------------------------------------Client: Option options sampler-table Exporter Format: NetFlow Version 9 Template ID : 258 Source ID : 1 Record Size : 51 ソフトウェアアップデートで対応予定 © 2013 Cisco and/or its affiliates. All rights reserved. Template layout _____________________________________________________________________ | Field | Type | Offset | Size | --------------------------------------------------------------------| v9-scope system | 1 | 0 | 4 | | flow sampler | 48 | 4 | 4 | | flow sampler name | 84 | 8 | 40 | | flow sampler algorithm export | 49 | 48 | 1 | | flow sampler interval | 50 | 49 | 2 | --------------------------------------------------------------------Client: Flow Monitor W-Mon-1 Exporter Format: NetFlow Version 9 Template ID : 264 Source ID : 65537 Record Size : 78 Template layout _____________________________________________________________________ | Field | Type | Offset | Size | --------------------------------------------------------------------| ipv4 source address | 8 | 0 | 4 | | ipv4 destination address | 12 | 4 | 4 | | transport source-port | 7 | 8 | 2 | | transport destination-port | 11 | 10 | 2 | | flow direction | 61 | 12 | 1 | | wireless ssid | 147 | 13 | 32 | | ip protocol | 4 | 45 | 1 | | application id | 95 | 46 | 4 | | counter bytes long | 1 | 50 | 8 | | counter packets long | 2 | 58 | 8 | | wireless ap mac address | 367 | 66 | 6 | | wireless client mac address | 365 | 72 | 6 | --------------------------------------------------------------------- Cisco Public 14 ※ラボ環境でのテストトラフィックです © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 ※ラボ環境でのテストトラフィックです ActionPacked! Networks社 LiveAction http://actionpacked.com/ © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 ※ラボ環境でのテストトラフィックです © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 17 ※ラボ環境でのテストトラフィックです © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 ※ラボ環境でのテストトラフィックです © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 • Cisco NGA www.cisco.com/go/nga • Catalyst 3850 www.cisco.com/jp/go/3850 www.cisco.com/go/3850 • Cisco Flexible NetFlow www.cisco.com/go/fnf • Cisco AVC (Application Visibility and Control) www.cisco.com/go/avc © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 Thank you.
© Copyright 2024 Paperzz