Forum Discussion

Anonymous's avatar
Anonymous
9 years ago

Juniper Netflow configuration examples

Like most of you, I have a long list of "To-do's" in our LogicMonitor deployment.  One that I just recently crossed off is capturing Netflow.  More accurately, capturing sFlow from Juniper EX/QFX s...
  • Michael_Dieter's avatar
    Michael_Dieter
    9 years ago

    OK, I've finally had a chance to validate this configuration and I can tell you that it works, with a few minor alterations....see below.

    I have deployed this on an MX-80 running Junos 13.3R9.13.  One other relevant addendum to my original "you need to know your MX HW & SW in detail" caveat: I have 20 x1 GE and 2 x 10GE MIC-3D powering my physical interfaces; if you have anything else consult Juniper documentation for sampling support information.  good luck with that :(

    set chassis fpc 1 sampling-instance NETFLOW-INSTANCE

    #####The above statement is valid for MX-240, MX-480, and MX-960 HW, though you will need to specify the fpc you want to use.  Also, there are very likely some limitations with regards to the number of sampling instances per fpc that you can create, the total number of instances that can be configured per chassis, and whether any single instance can span multiple fpc.

    #####The below statement is valid for MX-80 HW.  Given that MX-80 has a single tfeb, there are almost certainly much stricter limitations that govern the configuration of the number and deployment of sampling instances.

    set chassis tfeb0 slot 0 sampling-instance NETFLOW-INSTANCE

     

    #####From here down is the same regardless of MX model, though of course the physical and logical interfaces will vary.


    set chassis network-services ip

    set services flow-monitoring  version9 template LM-V9 option-refresh-rate seconds 25
    set services flow-monitoring  version9 template LM-V9 template-refresh-rate seconds 15
    set services flow-monitoring  version9 template LM-V9 ipv4-template


    set forwarding-options sampling instance NETFLOW-INSTANCE input rate 1 run-length 0
    set forwarding-options sampling instance NETFLOW-INSTANCE family inet output flow-server 192.168.1.2 port 2055
    set forwarding-options sampling instance NETFLOW-INSTANCE family inet output flow-server 192.168.1.2 source 192.168.10.1   source-address 192.168.10.1
    set forwarding-options sampling instance NETFLOW-INSTANCE family inet output flow-server 192.168.1.2 version9 template LM-V9
    set forwarding-options sampling instance NETFLOW-INSTANCE family inet output inline-jflow source-address 192.168.10.1

    set interfaces ge-1/3/3 unit 2630 family inet sampling input
    set interfaces ge-1/3/3 unit 2630 family inet sampling output

     

Michael_Dieter's avatar
Michael_Dieter
Icon for Neophyte rankNeophyte
9 years ago

I previously posted about sFlow export from Juniper EX/QFX5100 switches.   This time I'll post about exporting Netflow v9 from
Juniper MX routers.  I'll start by noting that little additional effort is needed as far as LogicMonitor goes and by strongly
reiterating that you should pay close attention to LM's best practices and think through carefully the details of your
implementation.
Then I'll provide these disclaimers: 1)conceptually, this is very similar to the way lots of features
are implemented --> create a definition and then specify how and where to apply it.  In practice I think it is painfully tedious
and Juniper's documentation contributes just as much to the difficulty as it does to providing an answer. Expect to burn a few hours to get this working  2)I actually can't
put this particular method of flow collection into production because it has both HW & SW constraints but I am confident
that it will work (it mirrors a working IPFIX configuration that was operating with a non-LM collector) as soon as I
get to the appropriate Juniper SW release (Junos 13.3Rx). The takeaway here is: you need to know your MX HW & SW in detail.
3)I offer no guarantees, your mileage may vary and ABSOLUTELY use the <commit confirmed> option when you turn this on.

NOTE also that I haven't included any links to Juniper documentation here, because well, there's too many references and which ones you will need is going to be driven by the MX router HW and SW that you are attempting to implement on.

set chassis fpc 1 sampling-instance NETFLOW-INSTANCE
set chassis network-services ip

set services flow-monitoring  version9 template LM-V9 option-refresh-rate seconds 25
set services flow-monitoring  version9 template LM-V9 template-refresh-rate seconds 15
set services flow-monitoring  version9 template LM-V9 ipv4-template


set forwarding-options sampling instance NETFLOW-INSTANCE input rate 1 run-length 0
set forwarding-options sampling instance NETFLOW-INSTANCE family inet output flow-server 192.168.1.2 port 2055
set forwarding-options sampling instance NETFLOW-INSTANCE family inet output flow-server 192.168.1.2 source 192.168.10.1
set forwarding-options sampling instance NETFLOW-INSTANCE family inet output flow-server 192.168.1.2 version9 template LM-V9
set forwarding-options sampling instance NETFLOW-INSTANCE family inet output inline-jflow source-address 192.168.10.1

set interfaces ge-1/3/3 unit 2630 family inet sampling input
set interfaces ge-1/3/3 unit 2630 family inet sampling output