Configuring Inline Active Flow Monitoring Using Routers, Switches or NFX250

Inline active flow monitoring is implemented on the Packet Forwarding Engine. The Packet Forwarding Engine performs functions such as creating and updating flows, and updating flow records. The flow records are sent out in industry-standard IPFIX or version 9 format.

On routers with MS-PICs or MS-DPCs, IPv4 and IPv6 fragments are processed accurately. The flow monitoring application creates two flows for every fragmented flow. The first fragment that has the complete Layer 4 information forms the first flow with 5-tuple data and subsequently, all the fragmented packets related to this flow form another flow with the Layer 4 fields set to zero.

The following limitations and restrictions apply to the inline active flow monitoring feature:

• Configuring both sFlow and inline active flow monitoring on the same interface leads to unexpected behavior. Therefore, configure these features on separate interfaces.

• Configuring both egress port mirroring and inline active flow monitoring on the same interface leads to unexpected behavior. Therefore, configure these features on separate interfaces.

• Ingress and egress sampling are sent to the same host-path queue. The packet rate in the queue is shared across ingress and egress sampled packets.

• Forwarding class configuration is not effective. Export record packets are always considered to be control frames and as such are pushed to the network-control queue.

• If multiple inline active flow monitoring firewall filters match to a flow, only the actions of the first filter are taken.

• In ingress sampling, if the destination port is on an aggregated Ethernet interface, the output interface is invalid.

The following considerations apply to the inline active flow monitoring instance configuration:

• Sampling run-length and clip-size are not supported.

• For inline configurations, collectors are not reachable via management interfaces, such as fxp0.

• Inline active flow monitoring does not support cflowd. Therefore, inline flow monitoring does not support the local dump option, which is available only with cflowd.

• Inline active flow monitoring is not supported when you enable Next Gen Services on an MX Series router.

• The number of collectors that are supported depends on the device:

  • In Junos OS Release 16.2 and in Junos OS Release 16.1R3 and earlier, you can configure only one collector under a family for inline active flow monitoring. Starting with Junos OS Release 16.1R4 and 17.2R1, you can configure up to four collectors under a family for inline active flow monitoring. Starting with Junos OS Evolved 20.3R1, for the PTX10003 and PTX10008 (with the JNP10K-LC1201 line card and the JNP10008-SF3) routers, you can configure up to four collectors for inline active flow monitoring. Starting with Junos OS Evolved 20.4R1, for the PTX10001-36MR and the PTX10008 (with the JNP10K-LC1202 line card and the JNP10008-SF3) routers, you can configure up to four collectors for inline active flow monitoring. Starting with Junos OS Evolved 21.1R1, for the PTX10004 router, you can configure up to four collectors for inline active flow monitoring. The Packet Forwarding Engine (PFE) can export the flow record, flow record template, option data, and option data template packet to all configured collectors. To configure a collector under a family for inline active flow monitoring, configure the flow-server statement at the [edit forwarding-options sampling instance instance-name family (inet | inet6 | mpls) output] hierarchy level. To specify up to four collectors, include up to four flow-server statements.

  • For inline configurations on all other devices, each family can support only one collector.

Inline active flow monitoring is configured using statements from four hierarchy levels:

• [edit chassis] —At this level, you associate the sampling instance with the FPC on which the media interface is present (except on the MX80 and MX104—see Configuring Inline Active Flow Monitoring on MX80 and MX104 Routers). If you are configuring sampling of IPv4 flows, IPv6 flows or VPLS flows (Junos OS only), you can configure the flow hash table size for each family, as described below.

• [edit firewall]—At this level, you configure a firewall filter for the family of traffic to be sampled. You must attach this filter to the interface on which you want to sample the traffic.

• [edit forwarding-options]—At this level, you configure a sampling instance and associate the template with the sampling instance. At this level, you also configure the flow-server IP address and port number as well as the flow export rate.

• [edit services flow-monitoring] —At this level, you configure the template properties for inline flow monitoring.

Before you configure inline active flow monitoring, you should ensure that you have adequately-sized hash tables for IPv4, IPv6, MPLS, and VPLS flow sampling. (VPLS flow sampling is Junos OS only). These tables can use one to fifteen 256K areas. Starting with Junos OS Release 16.1R1 and 15.1F2, the IPv4 table is assigned a default value of 1024. Prior to Junos OS Release 16.1 and 15.1F2, the IPv4 table is assigned a default value of fifteen 256K areas. The IPv6 table is assigned a default value of 1024, and the VPLS table is assigned a default value of 1024. When anticipated traffic volume requires larger tables, allocate larger tables.

To allocate flow hash tables: