Example: Sampling Instance Configuration
You can configure active sampling using a sampling instance and associate that sampling instance to a particular Flexible Port Concentrator (FPC), Modular Port Concentrator (MPC), or Dense Port Concentrator (DPC). In addition, you can define multiple sampling instances associated with multiple destinations and protocol families per sampling instance destination.
Example Network Details
The following example shows the configuration of two sampling instances on an MX480 router running Junos OS Release 9.6.
In Figure 1, packets
from Router 1 arrive on the monitoring router's Gigabit Ethernet ge-0/1/0 interface, the packets are sampled by the services
interface sp-2/0/0 and sent to the cflowd server by the
export interface ge-1/0/4. Packets from Router 3 arrive
on the monitoring router’s Gigabit Ethernet ge-3/1/0 interface, the packets are sampled by the services interface sp-2/1/0 and sent to the cflowd server by the export interface ge-1/0/4. Normal traffic flow from ge-0/1/0 and ge-3/1/0 to ge-1/0/0 and on to Router 2 continues
undisturbed during the sampling process. In active flow monitoring,
both the input interface and exit interface can be any interface type
(such as SONET/SDH, Gigabit Ethernet, and so on).
Only one sampling instance can be attached to an FPC, MPC, or DPC. Multiple families can be configured under a sampling instance. Each family can have its own collector address. You can define sampling instances and attach each instance to different FPCs, or a single sampling instance can be attached to all FPCs.
The sampling configuration for this example includes the following:
Two sampling instances,
s0ands1, configured to collect sampling data at the[edit forwarding-options]hierarchy level. Theflow-serverstatement includes the IP address, port, and template of the flow server. Theinterfacestatement includes the services interface,sp-2/0/0orsp-2/1/0, for flow record processing, and the source address of the incoming router on the sampled interface.The binding of the two sampling instances to FPCs 0 and 3. These are configured with the
sampling-instancestatement at the[edit chassis fpc slot]hierarchy level.Sampling activated on the input interfaces
ge-0/1/0andge-3/1/0using thesamplingstatement at the[edit interfaces interface-name unit unit-number family family]hierarchy level.
In this example, the ping command is issued on Router
1 to Router 2 via the MX480 router to generate traffic. After the
packets are generated, show commands are issued to verify
that the sampling configuration is working as expected.
Example Router Configuration
The following output shows the configuration of an MX480 router with two sampling instances.
user@MX480–router> show configuration
[...Output Truncated...]
}
chassis {
fpc 0 { # The fpc number is associated with the interface on which sampling is enabled, ge-0/1/0 in this statement.
sampling-instance s0;
}
fpc 3 { # The fpc number is associated with the interface on which sampling is enabled, ge-3/1/0 in this statement.
sampling-instance s1;
}
}
interfaces {
ge-0/1/0 { # This interface has sampling activated.
unit 0 {
family inet {
sampling { # Here sampling is activated.
input;
}
address 10.0.0.1/30;
}
}
}
ge-1/0/0 { # The interface on which packets are exiting the router.
unit 0 {
family inet {
address 192.0.2.1/30;
}
}
}
ge-1/0/4 { # The interface connected to the cflowd server.
unit 0 {
family inet {
address 198.51.100.1/32;
}
}
}
sp-2/0/0 { # The service interface that samples the packets from Router 1.
unit 0 {
family inet;
}
}
sp-2/1/0 { # The service interface that samples the packets from Router 3.
unit 0 {
family inet;
}
}
ge-3/1/0 { # This interface has sampling activated.
unit 0 {
family inet {
sampling { # Here sampling is activated.
input;
}
address 192.168.2.1/30;
}
}
}
}
forwarding-options {
sampling {
instance {
s0 {
input {
rate 1;
run-length 0;
}
family inet {
output {
flow-server 198.51.100.2 { # The address of the external server.
port 2055;
version9 {
template {
v4
}
}
}
interface sp-2/0/0 {
source-address 192.168.1.1; # Source address of the sampled packets
}
}
}
}
s1 {
input {
rate 1;
run-length 0;
}
family inet {
output {
flow-server 198.51.100.2 { # The address of the external server.
port 2055;
version9 {
template {
v4
}
}
}
interface sp-2/1/0 {
source-address 192.168.1.2; # Source address of the sampled packets
}
}
}
}
}
}
}
routing-options {
static {
route 203.0.113.0/8 next-hop 192.0.2.2;
}
}
services {
flow-monitoring {
version9 {
template v4 {
flow-active-timeout 30;
flow-inactive-timeout 30;
ipv4-template;
}
}
}
}Configuration Commands Used for the Configuration Example
The following set commands are used for the configuration
of the sampling instance in this example. Replace the values in these
commands with values relevant to your own network.
set chassis fpc 0 sampling-instance s0set chassis fpc 3 sampling-instance s1set interfaces ge-0/1/0 unit 0 family inet sampling inputset interfaces ge-0/1/0 unit 0 family inet addressset interfaces ge-1/0/0 unit 0 family inet addressset interfaces sp-2/0/0 unit 0 family inetset interfaces sp-2/1/0 unit 0 family inetset interfaces ge-3/1/0 unit 0 family inet sampling inputset interfaces ge-3/1/0 unit 0 family inet addressset forwarding-options sampling instance s0 input rate 1set forwarding-options sampling instance s0 input run-length 0set forwarding-options sampling instance s0 family inet output flow-server 198.51.100.2 port 2055set forwarding-options sampling instance s0 family inet output flow-server 198.51.100.2 version9 template v4;set forwarding-options sampling instance s0 family inet output interface sp-2/0/0 source-address 192.168.1.1set forwarding-options sampling instance s1 input rate 1set forwarding-options sampling instance s1 input run-length 0set forwarding-options sampling instance s1 family inet output flow-server 198.51.100.2 port 2055set forwarding-options sampling instance s1 family inet output flow-server 198.51.100.2 version9 template v4;set forwarding-options sampling instance s1 family inet output interface sp-2/1/0 source-address 192.168.1.2set routing-options static route 203.0.113.0/8 next-hop 192.0.2.2set services flow-monitoring version9 template v4 flow-active-timeout 30set services flow-monitoring version9 template v4 flow-inactive-timeout 30set services flow-monitoring version9 template v4 ipv4-template
Verifying Your Work
To verify that your configuration is working as expected, use the following commands on the router that is configured with the sampling instance:
show services accounting aggregation template template-name template-nameshow services accounting flow
The following shows the output of the show commands
issued on the MX480 router used in this configuration example:
user@MX480–router> show services accounting aggregation template template-name v4
Src Dst
Port/ Port/
Source Destination ICMP ICMP Packet
Address Address Type Code Proto TOS Count
10.0.0.6 203.0.113.3 100 1000 17 8 14
10.0.0.5 203.0.113.2 100 1000 17 8 15
10.0.0.3 203.0.113.3 100 1000 17 8 15
10.0.0.2 203.0.113.3 100 1000 17 8 15
10.0.0.4 203.0.113.2 100 1000 17 8 15
10.0.0.6 203.0.113.2 100 1000 17 8 15
10.0.0.4 203.0.113.3 100 1000 17 8 15
10.0.0.2 203.0.113.2 100 1000 17 8 16
10.0.0.3 203.0.113.2 100 1000 17 8 15
10.0.0.5 203.0.113.3 100 1000 17 8 15
user@MX480–router> show services accounting aggregation template template-name v4
Src Dst
Port/ Port/
Source Destination ICMP ICMP Packet
Address Address Type Code Proto TOS Count
10.0.0.6 203.0.113.3 100 1000 17 8 16
10.0.0.5 203.0.113.2 100 1000 17 8 17
10.0.0.3 203.0.113.3 100 1000 17 8 16
10.0.0.2 203.0.113.3 100 1000 17 8 16
10.0.0.4 203.0.113.2 100 1000 17 8 17
10.0.0.6 203.0.113.2 100 1000 17 8 17
10.0.0.4 203.0.113.3 100 1000 17 8 16
10.0.0.2 203.0.113.2 100 1000 17 8 17
10.0.0.3 203.0.113.2 100 1000 17 8 17
10.0.0.5 203.0.113.3 100 1000 17 8 16
user@MX480–router> show services accounting flow
Flow information
Interface name: sp-2/0/0, Local interface index: 152
Flow packets: 884, Flow bytes: 56576
Flow packets 10-second rate: 0, Flow bytes 10-second rate: 628
Active flows: 10, Total flows: 35
Flows exported: 75, Flows packets exported: 14
Flows inactive timed out: 25, Flows active timed out: 75
user@MX480–router> show services accounting flow
Flow information
Interface name: sp-2/0/0, Local interface index: 152
Flow packets: 898, Flow bytes: 57472
Flow packets 10-second rate: 0, Flow bytes 10-second rate: 628
Active flows: 10, Total flows: 35
Flows exported: 75, Flows packets exported: 14
Flows inactive timed out: 25, Flows active timed out: 75