Configuring Flow Aggregation on PTX Series Routers to Use Version 9 Flow Templates
You can define a flow record template suitable for IPv4 traffic or IPv6 traffic using a version 9 flow template. Templates and the fields included in the template are transmitted to the collector periodically. The collector does not affect the router configuration. You can define template refresh rate, flow active timeout and inactive timeout.
If flow records are being sent for multiple protocol families (for example, for IPv4 and IPv6), each protocol family flow will have a unique Observation Domain ID.
Configuring the Version 9 Template Properties
To define the version 9 templates, include the following statements
at the [edit services flow-monitoring version9] hierarchy
level:
[edit services flow-monitoring version9] template name { options-template-id template-id observation-domain-id flow-active-timeout seconds; flow-inactive-timeout seconds; option-refresh-rate packets packets seconds seconds; template-refresh-rate packets packets seconds seconds; (ipv4-template | ipv6-template); }
The following details apply to the configuration statements:
You assign each template a unique name by including the
template namestatement.You specify each template for the appropriate type of traffic by including the
ipv4-templateoripv6–template.Within the template definition, you can optionally include values for the
flow-active-timeoutandflow-inactive-timeoutstatements. These statements have specific default and range values when they are used in template definitions; the default is 60 seconds and the range is from 10 through 600 seconds.You can also include settings for the
option-refresh-rateandtemplate-refresh-ratestatements within a template definition. For both of these properties, you can include a timer value (in seconds) or a packet count (in number of packets). For thesecondsoption, the default value is 600 and the range is from 10 through 600. For thepacketsoption, the default value is 4800 and the range is from 1 through 480,000.To filter IPv6 traffic on a media interface, the following configuration is supported:
interfaces interface-name { unit 0 { family inet6 { sampling { input; output; } } } }
Restrictions
The following restrictions apply to version 9 templates:
Outbound Routing Engine traffic is not sampled. A firewall filter is applied as output on the egress interface, which samples packets and exports the data. For transit traffic, egress sampling works correctly. For internal traffic, the next hop is installed in the Packet Forwarding Engine but sampled packets are not exported.
Flows are created only after the route record resynchronization operation is complete, which takes 120 seconds.
Customizing Template ID, Observation Domain ID, and Source ID for Version 9 flow Templates
For PTX Series routers with third generation FPCs installed, the FPC’s slot number is used for the observation domain ID.
Use of version 9 flow templates allow you to define a flow record template suitable for IPv4 traffic or IPv6 traffic. Templates and the fields included in the template are transmitted to the collector periodically, and the collector does not need to be aware of the router configuration. Template IDs 0 through 255 are reserved for template sets, options template sets, and other sets for future use. Template IDs of data sets are numbered from 256 through 65535. Typically, this information element or field in the template is used to define the characteristics or properties of other information elements in a template. After a restart of the export process of templates is performed, template IDs can be reassigned.
The corresponding data sets and option data sets contain the value of the template IDs and options template IDs respectively in the set ID field. This method enables the collector to match a data record with a template record.
Fields Included in the IPv4 Templates for PTX Series Routers
Table 1 shows the fields that are available in the IPv4 templates.
Field |
Element ID |
|---|---|
IPv4 Source Address |
8 |
IPv4 Destination Address |
12 |
IPv4 TOS |
5 |
IPv4 Protocol |
4 |
L4 Source Port |
7 |
L4 Destination Port |
11 |
ICMP Type and Code |
32 |
Input Interface |
10 |
Source AS |
16 |
Destination AS |
17 |
BGP Next Hop Address |
18 |
Output Interface |
14 |
Number of Flow Bytes |
1 |
Number of Flow Packets |
2 |
Time the flow started with respect to system up time (FPC up time) |
22 |
Time the flow ended with respect to system up time (FPC up time) |
21 |
IPv4 Next Hop Address |
15 |
IPv4 Source Mask |
9 |
IPv4 Destination Mask |
13 |
TCP Flags |
6 |
IP Protocol Version |
60 |
Fields Included in the IPv6 Templates for PTX Series Routers
Table 2 shows the fields that are available in the IPv6 templates.
Field |
Element ID |
|---|---|
IPv6 Source Address |
27 |
IPv6 Destination Address |
28 |
IPv6 TOS |
5 |
IPv6 Protocol |
4 |
L4 Source Port |
7 |
L4 Destination Port |
11 |
ICMP Type and Code |
32 |
Input Interface |
10 |
Source AS |
16 |
Destination AS |
17 |
Output Interface |
14 |
Number of Flow Bytes |
1 |
Number of Flow Packets |
2 |
Time the flow started with respect to system up time (FPC up time) |
22 |
Time the flow ended with respect to system up time (FPC up time) |
21 |
IPv6 Next Hop Address |
62 |
IPv6 Source Mask |
29 |
IPv6 Destination Mask |
30 |
TCP Flags |
6 |
IP Protocol Version |
60 |
Verification
The following show commands are supported for version 9:
show services accounting flow inline-jflow fpc-slot fpc-slotshow services accounting errors inline-jflow fpc-slot fpc-slotshow services accounting status inline-jflow fpc-slot fpc-slot
Example: Configuring an version 9 Flow Templates and Flow Sampling
The following is a sample version 9 template configuration:
services {
flow-monitoring {
version9 {
template ipv4 {
flow-active-timeout 60;
flow-inactive-timeout 70;
template-refresh-rate seconds 30;
option-refresh-rate seconds 30;
ipv4-template;
}
}
}
}
chassis;
fpc 0 {
sampling-instance s1;
}
The following example applies the version 9 template to enable sampling of traffic for billing:
forwarding-options {
sampling {
instance {
s1 {
input {
rate 10;
}
family inet {
output {
flow-server 11.11.4.2 {
port 2055;
version9 {
template {
ipv4;
}
}
}
inline-jflow {
source-address 11.11.2.1;
}
}
}
}
}
}
}