Reset Search
 

 

Article

How To Configure the S-Series or PV FC-180 for Flow Collection to a Purview Appliance

« Go Back

Information

 
TitleHow To Configure the S-Series or PV FC-180 for Flow Collection to a Purview Appliance
Objective
  • To configure device to forward mirrored traffic and netflow frames to a Purview appliance.
  • To configure GRE tunnel to Purview appliance
  • To show sample configuration to send data to Purview.
Environment
  • S-Series
  • PV-FC-180 (see additional notes at bottom)
Procedure
The below are configuration samples followed by explanations of what the command does. This sample is for reference only, actual ports, addresses will need to be specific for the customer environment.

The first section of configuration we will tackle is the Netflow configuration. Without this, there is no data that will be analyzed by the appliance.
 
set netflow export-interval 1
set netflow export-destination 10.0.0.220 2055
set netflow export-version 9
set netflow port tg.1.1-2 enable rx
set netflow template refresh-rate 30 timeout 1
set netflow cache enable

So for the above configuration, The 10.0.0.220 is the destination IP of the flow collector.
The ports it collects netflow from are tg.1.1-2. These uplinks in the network or are actually ports that are being mirrored two from other products. We use the rx attribute so we do not expect any reverse data flow going up those ports we wish to report on.

If no netflow data is being seen at this point on the collector, use the following command
set ip interface vlan.0.x default
The vlan.0.x should be a connected vlan on the box, either the default vlan used for an IP, or any routed interface that is active.


In order to get actual flows generated on ports tg.1.1-2 we need  a policy configuration made to scan for the data in the packets. It needs to include two ports as it scans only on the inbound or RX part of the data. If a remote device is mirroring two-way traffic to the flow collector, then only one port is needed.
set policy profile 1 name Application pvid-status enable pvid 4095 mirror-destination 1
set policy rule admin-profile port tg.1.1-2 mask 16 port-string tg.1.1-2 admin-pid 1

In the above, pvid 4095 will be used if you wish to pass traffic back and forth on those uplinks. Use pvid 0 if you wish to drop this traffic. For the PV-FC-180, that should always be the case for the collecting ports. Be mindful of this command a pvid 0  policy done incorrectly can bring a network down.

Next we need to use a physical port on the switch to forward mirror traffic to. We will use ge.1.3. If the mirror destination port is linked physically directly to eth1 on the Purview appliance than hook them up as such. If a GRE tunnel is going to be used, then ge.1.3 will remain physically unplugged, but used for configuration purposes. For more on this review this article:Mirror Port in GRE Tunnel setup does not work.
set mirror create 1
set mirror 1 mirrorN 15
set mirror ports ge.1.3 1
Further IF we use a GRE tunnel, we will need to hard-set speed and duplex on the port (if it is not a 10g or tg.x.x port). Otherwise, the previous section is all you need to proceed. (also see notes below if using a PV-FC-180 device)
set port duplex ge.1.1-3 full
set port speed ge.1.1-3 1000
 Important Note!  If Using a Fiber Port (the dummy Port, where no cable is connected) for the Mirroring, make sure the GBIC is inserted.

Now we need to configure from the routing portion to include a loopack or standard interface (such as vlan.0.1) and tun.0.1 to represent the GRE tunnel. On the Purview appliance, use the loopback IP address specified below, not any other management IP address for the remote device. Make sure your routing interface (vlan.0.x or loop.0.x, does not have 'no ip forwarding and no proxy arp'. This will keep the gre burn port, such as ge.1.3 , from becoming operation via the 'show port status ge.1.3' command.
 
interface loop.0.1
ip address 10.10.10.1 255.255.255.255 primary
no shutdown
exit
interface tun.0.1
tunnel destination 10.0.0.220
tunnel mode gre l2 ge.1.3
tunnel mirror enable
tunnel source 10.10.10.1
no shutdown
exit

Where the GRE tunnel may traverse the network, make sure the Jumbo frames are enabled. For most EOS based switches, set port jumbo enable x.x.x is used.
We need this since GRE takes full size ethernet frames (default MTU of 1500) and then encapsulates it from there. Making them too large without jumbo frames enabled.
Additional notes
For PV-FC-180, to avoid the use of a burn port, the following configuration sample can be used to use as  tbp (tunnel bridge port) and not use a physical link on this device.
This is supported for this product only.
 

in Software version 8.42.01 (is GA) we had add an function to the PV-FC-180.
which allow the tunnel source will be an tbp.0.x (transparent bridge port)
so the config should look like that:

!
interface tun.0.1
tunnel destination 1.1.1.1
tunnel mode gre l2 tbp.0.10
tunnel mirror enable
tunnel source 1.1.2.1
tunnel probe probe-name default
no shutdown
exit
!
set mirror create 1
set mirror 1 mirrorN 15
set mirror ports tbp.0.10 1


This has been ONLY added in the PV-FC-180 platform.

If when you add a loopback and the PV-FC-180 becomes unreachable, check to see if the ip forwarding is enabled on the interface. If setup as a switch initially, this gets disabled. (also noted above)

Common commands to troubleshoot.
show run
show port status -interesting
show config mirror
show config policy
show config netflow
show netflow stat


For further information on testing Purview appliance for functionality:
How do I know if my Purview appliance is working correctly?

For further information on what the configuration of the Purview Appliance may look like see Sample configuration for Purview appliance to use a GRE interface

Feedback

 

Was this article helpful?


   

Feedback

Please tell us how we can make this article more useful.

Characters Remaining: 255