Directing Replicated Flows from M and T Series Routers to Multiple Flow Servers
You can configure replication of the sampled flow records for use by multiple flow servers. You can use either sampling based on the Routing Engine, using cflowd version 5 or version 8, or sampling based on the services PIC, using flow aggregation version 9.
Directing Replicated Routing Engine–Based Sampling Flows to Multiple Servers
Routing Engine–based sampling supports up to eight flow servers for both cflowd version 5 and version 8 configurations. The total number of servers is limited to eight regardless of how many are configured for cflowd v5 or v8.
When you configure cflowd-based sampling, the export packets are replicated to all flow servers configured to receive them. If two servers are configured to receive v5 records, both the servers receive records for a specified flow.
With Routing Engine–based sampling, if multiple flow servers
are configured with version 8 export format, all of them must use
the same aggregation type. For example, all servers receiving version
8 export can be configured for source-destination aggregation
type.
The following configuration example allows replication of export packets to two flow servers.
forwarding-options {
sampling {
instance inst1 {
input {
rate 1;
}
family inet;
output {
flow-server 10.10.3.2 {
port 2055;
version 5;
source-address 192.168.164.119;
}
flow-server 172.17.20.62 {
port 2055;
version 5;
source-address 192.168.164.119;
}
}
}
}
}
}
Directing Replicated Version 9 Flow Aggregates to Multiple Servers
The export packets generated for a template are replicated to all the flow servers that are configured to receive information for that template. The maximum number of servers supported is eight.
This also implies that periodic updates required by version 9 (RFC 3954) are sent to each configured collector. The following updates are sent periodically as part of this requirement:
Options data
Template definition
The refresh period for options data and template definition
is configured on a per-template basis at the [edit services flow-monitoring] hierarchy level.
The following configuration example allows replication of version 9 export packets to two flow servers.
forwarding-options {
sampling {
instance inst1 {
input {
rate 1;
}
family inet;
output {
flow-server 10.10.3.2 {
port 2055;
version9 {
template {
ipv4;
}
}
}
flow-server 172.17.20.62 {
port 2055;
version9 {
template {
ipv4;
}
}
}
}
flow-inactive-timeout 30;
flow-active-timeout 60;
interface sp-4/0/0 {
source-address 10.10.3.4;
}
}
}
}
}