You can use flow monitoring to help with network administration.
Active flow monitoring on PTX Series routers allows you to collect
sampled packets, then the router does GRE encapsulation of the packets
and sends them to a remote server for flow processing. The GRE encapsulation
includes an interface index and GRE key field. The GRE encapsulation
removes MPLS tags. You configure one or more port-mirroring instances
to define which traffic to sample and configure a server to receive
the GRE encapsulated packets. You configure a firewall filter on interfaces
where you want to capture flows. You can configure as many as 48 port-mirroring
instances.
To configure the router to do GRE encapsulation of sampled
packets and send them to a remote server for flow processing:
- Configure one or more server profiles that specify a
host where GRE encapsulated sampled packets are sent, and optionally,
a source address to include in the header of each sampled packet.
- Specify a name for each server profile and an IP address
of the host where sampled packets are sent:
[edit services hosted-services]
user@host# set server-profile server-profile-name server-address ipv4-address
- (Optional) For each server profile, specify a source address
to include in the header of each sampled packet:
[edit services hosted-services server-profile server-profile-name]
user@host# set client-address ipv4-address
Note: The default client address is 0.0.0.0. You must specify
an IPv4 address as the client address. You can also specify the loopback
address or management interface address as the client address.
- Configure one or more port-mirroring instances.
- Specify a name for each port-mirroring instance:
[edit forwarding-options port-mirroring]
user@host# set instance instance-name
Note: You can configure a maximum of 48 port-mirroring instances.
- Specify a protocol family for each port-mirroring instance:
[edit forwarding-options port-mirroring instance instance-name]
user@host# set family (inet | inet6 )
- To set the ratio of the number of packets to sample, specify
a value from 1 through 65,535 for each port-mirroring instance:
[edit forwarding-options port-mirroring instance instance-name input]
user@host# set rate number
Note: You must specify a value for the rate statement.
The default value is zero, which effectively disables sampling. If,
for example, you specify a rate value of 4, every fourth packet (1
packet out of 4) is sampled.
- (Optional) Specify the number of samples to collect after
the initial trigger event for each port-mirroring instance:
[edit forwarding-options port-mirroring instance instance-name input]
user@host# set run-length number
Note: The default value is zero. You can specify a number up
to 20.
- To designate a host where sampled traffic is sent, specify
the name of server profile configured at the
[edit services hosted-services] hierarchy level for each port-mirroring instance:[edit forwarding-options port-mirroring instance instance-name family ( inet | inet6) output]
user@host# set server-profile server-profile-name
- Configure one or more firewall filters.
- For each firewall filter, specify a protocol family, filter
name, and match conditions:
[edit firewall]
user@host# set filter family (inet | inet6) filter filter-name term term-name from match-condtions
- For each firewall filter you configure, specify the name
of a port-mirroring instance you configured at the
[edit forwarding-options] hierarchy level as a nonterminating action so that the traffic that
matches that instance is sampled: [edit firewall family (inet | inet6) filter filter-name term term-name]
user@host# set then port-mirroring instance instance-name
- Apply each firewall filter to an interface to evaluate
incoming traffic:
[edit interfaces interface-name unit logical-unit-number]
user@host# set family (inet | inet6) filter input firewall-filter-name
Note: Active flow monitoring is supported only on incoming traffic.
You cannot apply firewall filters to evaluate outgoing traffic.
- Configure the remote server, where GRE encapsulated packets
are sent, to perform flow processing.
