Cisco UCS NetFlow Monitoring

NetFlow is a standard network protocol for collecting IP traffic data. NetFlow enables you to define a flow in terms of unidirectional IP packets that share certain characteristics. All packets that match the flow definition are collected and exported to one or more external NetFlow Collectors, where they can be further aggregated, analyzed, and used for application-specific processing.

The Cisco UCS Manager uses NetFlow-capable adapters (Cisco UCS VIC 1240, Cisco UCS VIC 1280, Cisco UCS VIC 1225, Cisco UCS VIC 1300 Series, and Cisco UCS VIC 1440 Series) to communicate with the routers and switches that collect and export flow information.

Note

NetFlow monitoring is not supported on Cisco UCS 6454 Fabric Interconnects. Also, for Release 3.0(2), NetFlow monitoring is supported for end-host mode only.

NetFlow components include

Network flows: A flow is a set of unidirectional IP packets that have common properties such as the source or destination of the traffic, routing information, and protocol used. Flows are collected when they match the definitions in the flow record definition.

 Flow record definitions: A flow record definition contains information about the properties used to define the flow, which can include both characteristic properties and measured properties. Characteristic properties, also called flow keys, are the properties that define the flow. The Cisco UCS Manager supports IPv4, IPv6, and Layer 2 keys. Measured characteristics, also called flow values or nonkeys, are measurable values such as the number of bytes contained in all packets of the flow or the total number of packets.

A flow record definition is a specific combination of flow keys and flow values. The two types of flow record definitions are

System-defined: Default flow record definitions supplied by the Cisco UCS Manager

User-defined: Flow record definitions that you can create yourself

Flow exporters, flow exporter profiles, and flow collectors: Flow exporters transfer the flows to the flow connector based on the information in a flow exporter profile. The flow exporter profile contains the networking properties used to export NetFlow packets. The networking properties include a VLAN, the source IP address, and the subnet mask for each fabric interconnect.

Note

In the Cisco UCS Manager GUI, the networking properties are defined in an exporter interface that is included in the profile. In the Cisco UCS Manager CLI, the properties are defined in the profile.

Flow collectors receive the flows from the flow exporter. Each flow collector contains an IP address, port, external gateway IP, and VLAN that defines where the flows are sent.

Flow monitors and flow monitor sessions: A flow monitor consists of a flow definition, one or two flow exporters, and a timeout policy (see Figure 13-10). You can use a flow monitor to specify which flow information you want to gather and where you want to collect it from. Each flow monitor operates in either the egress or ingress direction.

Figure 13-10 UCS NetFlow Configuration Example

A flow monitor session contains up to four flow monitors—two flow monitors in the ingress direction and two flow monitors in the egress direction. A flow monitor session can also be associated with a vNIC.

Leave a Reply

Your email address will not be published. Required fields are marked *