Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Configuring Inline Active Flow Monitoring on PTX Series Routers

This topic describes how to configure inline active flow monitoring on PTX Series routers for IPv4 and IPv6 traffic.

Platform and Feature Support

Table 1 lists the PTX Series platform support for various types of traffic for inline active flow monitoring.

Table 1: PTX Series Platform Support for Inline Active Flow Monitoring

Platform

Support

PTX3000 Series

Junos OS 18.1R1—IPv4 and IPv6 traffic (both IPFIX and version 9)

Junos OS 18.2R1—MPLS, MPLS-IPv4, and MPLS-IPv6 traffic.

PTX5000 Series

Junos OS 18.1R1—IPv4 and IPv6 traffic (both IPFIX and version 9)

Junos OS 18.2R1, MPLS, MPLS-IPv4, and MPLS-IPv6 traffic.

PTX1000

Junos OS 17.3R1—IPv4 and IPv6 traffic (version 9 only).

PTX10001-36MR

Junos OS Evolved 20.3R1—IPv4, IPv6, MPLS, MPLS-IPv4, and MPLS-IPv6 traffic.

PTX10002-60C

Junos OS 18.4R1—IPv4 and IPv6 traffic (both IPFIX and version 9).

Junos OS 19.4R1—MPLS, MPLS-IPv4, and MPLS-IPv6 traffic.

PTX10003

Junos OS Evolved 19.3R1—IPv4 and IPv6 traffic (IPFIX and version 9).

Junos OS Evolved 20.1R1—MPLS, MPLS-IPv4, and MPLS-IPv6 traffic.

PTX10004

Junos OS Evolved 20.4R1—IPv4, IPv6, MPLS, MPLS-IPv4, and MPLS-IPv6 traffic (IPFIX and version 9).

PTX10008 (with the JNP10008-SF3 and the JNP10K-LC1201 line card)

Junos OS Evolved 19.3R1—IPv4 and IPv6 traffic (IPFIX and version 9).

Junos OS Evolved 20.1R1—MPLS, MPLS-IPv4, and MPLS-IPv6 traffic.

PTX10008 (with the JNP10008-SF3 and the JNP10K-LC1202 line card)

Junos OS Evolved 20.3R1—IPv4, IPv6, MPLS, MPLS-IPv4, and MPLS-IPv6 traffic (IPFIX and version 9).

PTX10008 (without the JNP10008-SF3) and PTX10016

Junos OS 18.1R1—IPv4 and IPv6 traffic (both IPFIX and version 9)

Junos OS 18.2R1—MPLS, MPLS-IPv4, and MPLS-IPv6 traffic.

To configure inline flow monitoring for MPLS-over UDP traffic on PTX Series Routers, see Inline Active Flow Monitoring of MPLS-over-UDP Flows on PTX Series Routers. Inline active flow monitoring for MPLS-over-UDP traffic is not supported on the PTX10001-36MR, PTX10003, PTX10004, and the PTX10008 (with the JNP10008-SF3) routers.

Starting in Junos OS Release 18.2R1, you can configure up to four collectors under a family for inline active flow monitoring. In previous releases of Junos OS, you could configure only one collector under a family for inline active flow monitoring. Starting in Junos OS Evolved 20.3R1, for the PTX10003 and PTX10008 (with the JNP10K-LC1201 line card and the JNP10008-SF3) routers, you can configure up to four collectors for inline active flow monitoring. Starting with Junos OS Evolved 20.4R1, for the PTX10001-36MR and the PTX10008 (with the JNP10K-LC1202 line card and the JNP10008-SF3) routers, you can configure up to four collectors for inline active flow monitoring. Starting with Junos OS Evolved 21.1R1, for the PTX10004 router, you can configure up to four collectors for inline active flow monitoring. To configure a collector under a family for inline active flow monitoring, configure the flow-server statement at the edit forwarding-options sampling-instance instance-name family (inet | inet6) output hierarchy level. To specify up to four collectors, include up to four flow-server statements.

Inline active flow monitoring is implemented on the Logical CPU (LCPU). All the functions like flow creation, flow update, and flow records export are done by the LCPU. The flow records are sent out in either the IPFIX format or the version 9 format.

Starting with Junos OS Evolved Release 21.2R1 and Junos OS Release 21.3R1, no flows are maintained. Every sampled packet is considered to be a flow. When the sampled packet is received, the flow is created and immediately timed out as inactive, and the software exports a record to the collector. Therefore, the number of records sent to the collector is higher than before. The IPFIX and version 9 Options Template Data Record now contains 0 in the Flow Active Timeout (Element ID 36) and Flow Inactive Timeout (Element ID 37) fields. Therefore, the Options Template Data Record is not compliant with IPFIX RFC 7011. The show services accounting flow inline-jflow fpc-slot slot operational mode command now displays 0 for all of the Active Flows and Timed Out fields. The values of the various Total Flows fields are now equal to their respective Flow Packets field values. The values of the various Flows Inactive Timed Out fields are now equal to their respective Flow Packets field values. The effect of the nexthop-learning statement at the [edit services flow-monitoring version version template template-name] hierarchy level on this no-flow behavior varies depending upon the operating system. For Junos OS Evolved, we do not recommend that you configure the nexthop-learning statement, as it reduces the number of packets that can be processed. For Junos OS, you can configure the nexthop-learning statement to change this default no-flow behavior and once again create and maintain flows, then attach the template to all sampling instances associated with FPCs that require the previous behavior.

The following limitations and restrictions apply to the inline active flow monitoring feature in Junos OS and Junos OS Evolved:

  • Egress MPLS filters are not supported on the PTX10001-36MR, PTX10003, PTX10004, and the PTX10008 (with the JNP10008-SF3) routers.

  • The PTX10001-36MR router does not support multiple FPC sampling collection because it has only 1 Routing Engine.

  • True outgoing interface (OIF) reporting is not supported for egress sampling. In Junos OS Evolved, true outgoing interface (OIF) reporting is not supported for GRE de-encapsulated packets.

  • The interface type field for the true incoming interface is not part of the version 9 template because this element is not present in the version 9 export version.

  • For tunneled traffic on the PTX10008 (with the JNP10008-SF3) routers, you configure an FTI interface to terminate a GRE tunnel. To sample this traffic, you configure a firewall filter with the sample action applied to the FTI interface. For tunneled traffic, the FTI interface is reported in the layer 2 header instead of the physical interface on which the tunnel traffic is received, is moved in or out of the aggregated Ethernet bundle, no new flow is created, because the FTI interface and the incoming interface reported in the layer 2 header are still the same. The export records reflect the incoming interface values of the aggregated Ethernet and the physical interface based on the configuration, so apart from the difference in flow creation behavior, there is no visible behavior change in this scenario.

    For the PTX10003 routers, you use a firewall filter to accept GRE-encapsulated traffic, count it, and then de-encapsulate it and sample it. Therefore, when physical interfaces are moved in or out of the aggregated Ethernet bundle, a new flow is created and the old flows will be timed out after a period of inactivity. However, for the PTX10008 (with the JNP10008-SF3) routers, no new flow is created.

How to Configure Inline Active Flow Monitoring on PTX Series Routers

SUMMARY In this example, we configure a version-ipfix template for recording IPv4 and IPv6 traffic flows.

Configure a Template to Specify Output Properties

  1. Define the template and configure the type of flow the template should record.

  2. (Optional) Configure additional output properties for the template, such as flow timeout interval and template/option refresh rates, to control the flow records.

    You can use the template-refresh-rate option to configure the frequency at which the flow generator sends updates about template definitions to the flow collector either using number of packets or seconds.

  3. (Optional)

    If you are monitoring MPLS flows, that is, if the template in use is configured for the MPLS protocol family, use the tunnel-observation option to identify the types of MPLS flows.

  4. (Optional) Enable the learning of next-hop addresses so that the true outgoing interface is reported.

    Note:

    Starting in Junos OS Evolved 21.2R1, we do not recommend that you enable learning of next-hop addresses, as it reduces the number of packets that can be processed. However, starting in Junos OS Release 21.3R1, you can configure the nexthop-learning statement to change the default no-flow behavior and once again create and maintain flows, then attach the template to all sampling instances associated with FPCs that require the previous behavior.

Configure a Sampling Instance to Specify Input Properties

  1. Define the sampling instance and configure the ratio of number of packets to be sampled. For example, if you specify a rate of 10, every tenth packet (1 packet out of 10) is sampled.

    Best Practice:

    We recommend that you use a value of 1000 or higher for MPLS flows.

  2. Configure the protocol family for the sampling instance and specify a flow collector to send the traffic aggregates.

  3. (Optional) Specify the UDP port for the flow collector and the template to use with the sampling instance.

  4. Configure inline processing of the sampled packets.

Assign the Sampling Instance to an FPC

  1. Assign the sampling instance to the FPC on which you want to implement flow monitoring.

Configure a Firewall Filter to Accept and Sample Flows

  1. Configure the firewall filter for the protocol family and enable sampling of traffic flows.

Assign the Firewall Filter to an Interface

  1. Assign the input firewall filter to the interface you want to monitor.

Results from a Sample Configuration

The following is an example of the sampling configuration for an instance that supports inline flow monitoring on family inet and on family inet6:

You can use the show services accounting flow command to verify active flow statistics.

Release History Table
Release
Description
21.3R1
21.3R1
For the PTX Series, starting with Junos OS Release 21.3R1 , no flows are maintained. Every sampled packet is considered to be a flow. When the sampled packet is received, the flow is created and immediately timed out as inactive, and the software exports a record to the collector. Therefore, the number of records sent to the collector is higher than before.
21.2R1-Evo
For the PTX Series, starting with Junos OS Evolved Release 21.2R1, no flows are maintained. Every sampled packet is considered to be a flow. When the sampled packet is received, the flow is created and immediately timed out as inactive, and the software exports a record to the collector. Therefore, the number of records sent to the collector is higher than before.
21.1R1-Evo
Starting with Junos OS Evolved 21.1R1, for the PTX10004 router, you can configure up to four collectors for inline active flow monitoring.
20.4R1-Evo
Starting with Junos OS Evolved 20.4R1, for the PTX10001-36MR and the PTX10008 (with the JNP10K-LC1202 line card and the JNP10008-SF3) routers, you can configure up to four collectors for inline active flow monitoring.
20.3R1-Evo
Starting in Junos OS Evolved 20.3R1, for the PTX10003 and PTX10008 (with the JNP10K-LC1201 line card and the JNP10008-SF3) routers, you can configure up to four collectors for inline active flow monitoring.
18.2R1
Starting in Junos OS Release 18.2R1, you can configure up to four collectors under a family for inline active flow monitoring. In previous releases of Junos OS, you could configure only one collector under a family for inline active flow monitoring.