Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

Directing Replicated Flows from M and T Series Routers to Multiple Flow Servers

date_range 13-Jan-21

You can configure replication of the sampled flow records for use by multiple flow servers. You can use either sampling based on the Routing Engine, using cflowd version 5 or version 8, or sampling based on the services PIC, using flow aggregation version 9.

Directing Replicated Routing Engine–Based Sampling Flows to Multiple Servers

Routing Engine–based sampling supports up to eight flow servers for both cflowd version 5 and version 8 configurations. The total number of servers is limited to eight regardless of how many are configured for cflowd v5 or v8.

When you configure cflowd-based sampling, the export packets are replicated to all flow servers configured to receive them. If two servers are configured to receive v5 records, both the servers receive records for a specified flow.

Note:

With Routing Engine–based sampling, if multiple flow servers are configured with version 8 export format, all of them must use the same aggregation type. For example, all servers receiving version 8 export can be configured for source-destination aggregation type.

The following configuration example allows replication of export packets to two flow servers.

content_copy zoom_out_map
forwarding-options {
    sampling {
        instance inst1 {
            input {
                rate 1;
            }
            family inet;
                output {
                    flow-server 10.10.3.2 {
                        port 2055;
                        version 5;
                        source-address 192.168.164.119;
                    }
                    flow-server 172.17.20.62 {
                        port 2055;
                        version 5;
                        source-address 192.168.164.119;
                    }
                }
            }
        }
    }
}

Directing Replicated Version 9 Flow Aggregates to Multiple Servers

The export packets generated for a template are replicated to all the flow servers that are configured to receive information for that template. The maximum number of servers supported is eight.

This also implies that periodic updates required by version 9 (RFC 3954) are sent to each configured collector. The following updates are sent periodically as part of this requirement:

  • Options data

  • Template definition

The refresh period for options data and template definition is configured on a per-template basis at the [edit services flow-monitoring] hierarchy level.

The following configuration example allows replication of version 9 export packets to two flow servers.

content_copy zoom_out_map
forwarding-options {
    sampling {
        instance inst1 {
            input {
                rate 1;
            }
            family inet;
                output {
                    flow-server 10.10.3.2 {
                        port 2055;
                        version9 {
                            template {
                                ipv4;
                            }
                        }
                    }
                    flow-server 172.17.20.62 {
                        port 2055;
                        version9 {
                            template {
                                ipv4;
                            }
                        }
                    }
                }
                flow-inactive-timeout 30;
                flow-active-timeout 60;
                interface sp-4/0/0 {
                    source-address 10.10.3.4;
                }
            }
        }
    }
}
footer-navigation