Configuring Inline Active Flow Monitoring on PTX Series Routers

Limitations and Restrictions

The following limitations and restrictions apply to the inline active flow monitoring feature in Junos OS and Junos OS Evolved:

• Egress MPLS filters are not supported on the PTX10001-36MR, PTX10003, PTX10004, and the PTX10008 (with the JNP10008-SF3) routers.

• The PTX10001-36MR router does not support multiple FPC sampling collection because it has only 1 Routing Engine.

• True outgoing interface (OIF) reporting is not supported for egress sampling. In Junos OS Evolved, true outgoing interface (OIF) reporting is not supported for GRE de-encapsulated packets.

• The interface type field for the true incoming interface is not part of the version 9 template because this element is not present in the version 9 export version.

• For GRE tunnel traffic on PTX10003 routers, the physical interface is reported in the layer 2 header and is considered as one of the keys during flow creation. Therefore, when physical interfaces are moved in or out of the aggregated Ethernet bundle, a new flow is created and the old flows are timed out after a period of inactivity. Physical interface, logical interface, or the aggregated logical interface (based on the configuration) is reported as the incoming interface in export records based on the configuration.

  For GRE tunnel traffic on PTX10008 (with the JNP10008-SF3) routers, an FTI interface is configured to terminate a GRE tunnel. This interface is used during flow creation as one of the keys instead of the physical interface. Hence when a physical interface is moved in or out of an aggregated Ethernet bundle, no new flow is created as the key remains unchanged. Physical interface, logical interface, or the aggregated logical interface (based on the configuration) is reported as the incoming interface in exported records.

Configure a Template to Specify Output Properties

1. Define the template and configure the type of flow the template should record.

   content_copy zoom_out_map

   [edit services flow-monitoring]
   user@host# set version-ipfix template template-name ipv4-template
   user@host# set version-ipfix template template-name ipv6-template
   user@host# set version-ipfix template template-name mpls-template
   

2. (Optional) Configure additional output properties for the template, such as flow timeout interval and template/option refresh rates, to control the flow records.

   You can use the template-refresh-rate option to configure the frequency at which the flow generator sends updates about template definitions to the flow collector either using number of packets or seconds.

   content_copy zoom_out_map

   [edit services flow-monitoring]
   user@host# set version-ipfix template template-name flow-active-timeout seconds
   user@host# set version-ipfix template template-name flow-inactive-timeout seconds
   user@host# set version-ipfix template template-name template-refresh-rate (packets packets | seconds seconds)
   user@host# set version-ipfix template template-name option-refresh-rate (packets packets | seconds seconds)

3. (Optional)

   If you are monitoring MPLS flows, that is, if the template in use is configured for the MPLS protocol family, use the tunnel-observation option to identify the types of MPLS flows.

   content_copy zoom_out_map

   [edit services flow-monitoring]
   user@host# set version-ipfix template template-name tunnel-observation (ipv4 | ipv6 | mpls-over-udp)
   

4. (Optional) Enable the learning of next-hop addresses so that the true outgoing interface is reported.

   Note:

   Starting in Junos OS Evolved 21.2R1, we do not recommend that you enable learning of next-hop addresses, as it reduces the number of packets that can be processed. However, starting in Junos OS Release 21.3R1, you can configure the nexthop-learning statement to change the default no-flow behavior and once again create and maintain flows, then attach the template to all sampling instances associated with FPCs that require the previous behavior.

   content_copy zoom_out_map

   [edit services flow-monitoring]
   user@host# set version-ipfix template template-name nexthop-learning enable
   

Configure a Sampling Instance to Specify Input Properties

1. Define the sampling instance and configure the ratio of number of packets to be sampled. For example, if you specify a rate of 10, every tenth packet (1 packet out of 10) is sampled.

   content_copy zoom_out_map

   [edit forwarding-options sampling]
   user@host# set instance instance-name input rate number
   

   Best Practice:

   We recommend that you use a value of 1000 or higher for MPLS flows.

2. Configure the protocol family for the sampling instance and specify a flow collector to send the traffic aggregates.

   content_copy zoom_out_map

   [edit forwarding-options sampling]
   user@host# set instance instance-name family (inet | inet6 | mpls) flow-server hostname
   

3. (Optional) Specify the UDP port for the flow collector and the template to use with the sampling instance.

   content_copy zoom_out_map

   [edit forwarding-options sampling]
   user@host# set instance instance-name family (inet | inet6 | mpls) flow-server hostname port port-number
   user@host# set instance instance-name family (inet | inet6 | mpls) flow-server hostname version-ipfix template template-name
   

4. Configure inline processing of the sampled packets.

   content_copy zoom_out_map

   [edit forwarding-options sampling]
   user@host# set instance instance-name family (inet | inet6 | mpls) output inline-jflow source-address address

Assign the Sampling Instance to an FPC

1. Assign the sampling instance to the FPC on which you want to implement flow monitoring.

   content_copy zoom_out_map

   [edit chassis]
   user@host# set fpc slot-number sampling-instance instance-name
   

Configure a Firewall Filter to Accept and Sample Flows

1. Configure the firewall filter for the protocol family and enable sampling of traffic flows.

   content_copy zoom_out_map

   [edit firewall]
   user@host# set family (inet | inet6 | mpls) filter filter-name
   user@host# set family (inet | inet6 | mpls) filter filter-name term term-name then accept
   user@host# set family (inet | inet6 | mpls) filter filter-name term term-name then sample
   

Assign the Firewall Filter to an Interface

1. Assign the input firewall filter to the interface you want to monitor.

   content_copy zoom_out_map

   [edit interfaces]
   user@host# set interface-name unit unit-number family (inet |inet6 | mpls) filter input filter-name
   

Results from a Sample Configuration

The following is an example of the sampling configuration for an instance that supports inline flow monitoring on family inet and on family inet6:

[edit chassis]
fpc 0 {
    sampling-instance sample-1;
}

[edit services]
flow-monitoring {
    version-ipfix {
        template test-template {
            flow-active-timeout 30;
            flow-inactive-timeout 60;
            nexthop-learning {
                enable;
            }
            template-refresh-rate {
                seconds 10;
            }
            ipv4-template;
        }
        template v6 {
            ipv6-template;
        }
    }
}

[edit interfaces]
et-1/0/0 {
    unit 0 {
        family inet {
            filter {
                input ipv4-filter;
                output ipv4-filter;
            }
            address 192.168.100.10/24;
        }
    }
}
et-1/0/2 {
    unit 0 {
        family inet6 {
            filter {
                input ipv6-filter;
                output ipv6-filter;
            }
            address 2001:db8:0:2::1/64;
        }
    }
}
lo0 {
    unit 0 {
        family inet {
            address 192.168.100.1/32;
        }
    }
}

[edit forwarding-options]
sampling {
    instance sample-1{
        ipv4 {
            input {
                rate 10;
            }
            family inet {
                output {
                    flow-server 10.208.174.127 {
                        port 2055;
                        version-ipfix {
                            template {
                                test-template;
                            }
                        }
                    }
                    inline-jflow {
                        source-address 192.168.100.1;
                    }
                }
            }
            family inet6 {
                output {
                    flow-server 10.208.174.127 {
                        port 2055;
                        version-ipfix {
                            template {
                                v6;
                            }
                        }
                    }
                    inline-jflow {
                        source-address 192.168.100.1;
                    }
                }
            }
        }
    }
}

[edit firewall]
family inet {
   filter ipv4-filter {
      term ipv4-accept {
         then { 
            accept;
            sample;
         }
      }
   }
}
family inet6 {
   filter ipv6-filter {
      term ipv6-accept {
         then {
            accept;
            sample;
         }
      }
   }
}

You can use the show services accounting flow command to verify active flow statistics.