Advanced NetFlow BRKNMS-3132 Benoit Claise, Distinguished Engineer . For Your Session Abstract Reference • This advanced session presents the latest NetFlow developments: new features, NetFlow version 9, and its IPFIX standardization at the IETF. Flexible NetFlow feature is covered in detail. Technical details of the new features are addressed with configuration examples, show commands, tricks, and best practice advice. Scenarios such as NetFlow for security and NetFlow for application visibility planning are covered. The NetFlow performance impact is also discussed, as well as the support matrix of all NetFlow features. • This session is for enterprise, service provider, and NREN experts engaged in designing, maintaining, and troubleshooting security, capacity planning, and accounting solutions. Attendees should be familiar with network management basics and should already have some understanding of NetFlow BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 3 The Content of This Session Is… • Not about – A level one type of presentation – Introduction to IP accounting and NetFlow – Marketing slides – NetFlow collector details – The ecosystem partners applications and mediations – Many platform specific details • About – New features – Advanced information – And a few scenarios … • Assuming the NetFlow basics are known BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 4 Agenda • Introduction • NetFlow Version 9 (with Traditional NetFlow) • Flexible NetFlow • NetFlow for Security • NetFlow for Application Visibility and Control • NetFlow & IPv6 • NetFlow Performance • NetFlow Standardization • Support Matrix • Conclusion BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 5 Version 5 Flow Format Flow Key vs. Non-Key Field From/to . Usage Packet count Source IP address . Byte count . Destination IP address Time . Start sysUpTime . Source TCP/UDP port of Day . End sysUpTime . Destination TCP/UDP port Application Port . Input ifIndex . Next hop address Utilization . Output ifIndex . Source AS number . Type of service . Dest. AS number QoS . TCP flags . Source prefix mask . Protocol . Dest. Prefix mask Routing and Peering BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public Traditional NetFlow 1. Create and update flows in NetFlow cache Src Src Src Dst DstM Dst Bytes/P Srclf SrclPadd Dstlf DstlPadd Protocol TOS Flgs Pkts NextHop Active Idle Port Msk AS Port sk AS kt Fa1/0 173.100.21.2 Fa0/0 10.0.227.12 11 80 10 11000 00A2 /24 5 00A2 /24 15 10.0.23.2 1528 1745 4 Fa1/0 173.100.3.2 Fa0/0 10.0.227.12 6 40 0 2491 15 /26 196 15 /24 15 10.0.23.2 740 41.5 1 Fa1/0 173.100.20.2 Fa0/0 10.0.227.12 11 80 10 10000 00A1 /24 180 00A1 /24 15 10.0.23.2 1428 1145.5 3 Fa1/0 173.100.6.2 Fa0/0 10.0.227.12 6 40 0 2210 19 /30 180 19 /24 15 10.0.23.2 1040 24.5 14 . Inactive timer expired (15 sec is default) . Active timer expired (30 min is default) => change it 1 min 2. Expiration . NetFlow cache is full (oldest flows are expired) . RST or FIN TCP flag Src Src Src Dst Dst Dst Bytes/ Srclf SrclPadd Dstlf DstlPadd Protocol TOS Flgs Pkts NextHop Active Idle Port Msk AS Port Msk AS Pkt Fa1/0 173.100.21.2 Fa0/0 10.0.227.12 11 80 10 11000 00A2 /24 5 00A2 /24 15 10.0.23.2 1528 1800 4 3. Aggregation 4. Export version E.g., Protocol-Port Aggregation Non-aggregated flows—export version 5, 9, IPFIX Scheme Becomes 5. Transport protocol Protocol Pkts SrcPort DstPort Bytes/Pkt Export Payload 11 11000 00A2 00A2 1528 (UDP) Packet (Flows) Aggregated Flows—Export Version 8 or 9 Header BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public Extensibility and Flexibility Requirements Phases Approach • Traditional NetFlow with v5 or v8 NetFlow export – New requirements: build something flexible and extensible • Phase One: NetFlow Version 9 (Lead to IPFIX at the IETF) – Advantages: extensibility • Integrate new technologies/data types quicker Exporting (MPLS, IPv6, BGP next hop, etc.) • Integrate new aggregations quicker Process – Note: for now, the template definitions are fixed • Phase Two: Flexible NetFlow – Advantages: cache and export content flexibility • User selection of flow keys Metering • User definition of the records Process BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 Exporting Process versus Metering Process and NetFlow Evolution The Metering Process generates Flow The Exporting Process sends Records. Inputs to the process are IPFIX Messages to one or more packet headers, characteristics, and Collecting Processes = the export Packet Treatment observed at one or protocol more Observation Points. – NetFlow export version 5, (version – Traditional NetFlow 7), version 8 – Flexible NetFlow – NetFlow export version 9 – Metric Mediation Agent (Mediation – IPFIX (RFC 7011), which is function exporting performance version 10 (NetFlow version 9 + 1) metrics) – and some others • Exporting Process versus Metering Process are IPFIX (IP Flow Information eXport) terms: the NetFlow term doesn’t make the distinction BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public Exporting Process versus Metering Process and NetFlow Evolution Use cases evolution and hence information elements evolution + Different sources of information (different metering processes) => we need some aggregation Export and correlation in the router => we need a super metering Metric Mediation process: the Metric Mediation Agent Agent Infrastructure Perf PA FNF NBAR2 QoS PfR firewall WAAS Mon (ART) BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 10 NetFlow Partners Traffic Analysis Denial of Service Billing CS-Mars http://www.cisco.com/en/US/prod/iosswrel/ps6537/ps6555/ps6601/networking_solutions_products_genericcontent0900aecd805ff728.html BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 Agenda • Introduction • NetFlow Version 9 (with Traditional NetFlow) • Flexible NetFlow • NetFlow for Security • NetFlow for Application Visibility and Control • NetFlow & IPv6 • NetFlow Performance • NetFlow Standardization • Support Matrix • Conclusion BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 NetFlow Version 9 • Version 9 is an export protocol – No changes to the metering process • Version 9 is based on templates and separate flow records – Templates expressing type and length – Flow records expressing template ID and list of values – Sent the template regularly (configurable), because of UDP • Support: 800, 1700, ISR (1800, 2800, 3800), ISR-G2 (1900, 2900, 3900), 2600, 3200, 3600, 3750, 4400, cat 3850, cat4500 , cat6500, 5760 (wireless controller), Cloud Services Router CSR-1000v, 7200, 7300, 7500, 7600, 10000, 12000 (IOS and IOS-XR), CRS-1, ASR 1000, ASR 9000, ASA 5580, Nexus 7000 and Nexus 1000V • RFC3954 Cisco Systems® NetFlow Services Export Version 9 – NetFlow patent: intellectual property right statement at the IETF website BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 NetFlow Version 9 Export Packet Template 1 Template 2 Template FlowSet Data FlowSet Data FlowSet H FlowSet ID #1 FlowSetFlowSet ID ID#1 #2 E Template Template Record Record Data Data Data A Template ID Template Record Record Record D #1 ID #2 (Field (Field (Field E (Specific (Specific Field Field Values) Values) Values) R Types and Types and Lengths) Lengths) BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 17 NetFlow Version 9 Export Packet Options Template FlowSet Specifies the Scope: Cache, System, Template, etc. Template 3 Options Data FlowSet H Template FlowSet FlowSet ID #3 E Option Option Option Template Record A Data Data Template Record Record D ID #3 (Specific Scope, E (Field (Field Field Types Values) Values) R and Lengths) BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 Interface Name Export with NetFlow Version 9 • Example of options template FlowSet: NetFlow exports the ifIndex • Instead of the collector polling the ifName MIB variable for a specific ifIndex, the matching (ifIndex, ifName) is sent in an option data record Router(config)# ip flow-export interface-names • Note: with Flexible NetFlow, Router(config)# option interface-table timeout <time> BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 Traditional NetFlow + NetFlow v9 Configuration router(config)# ip flow-export version [5|9] [origin-as|peer-as] [bgp-nexthop] router(config)# ip flow-export template options export-stats router(config)# ip flow-export template options timeout-rate 5 router(config)# ip flow-export template options refresh-rate 20 router(config)# ip flow-export template timeout-rate 5 router(config)# ip flow-export template refresh-rate 20 router(config)# ip flow-export destination 10.10.10.10 9996 (Options)(Options) Templates Templates Sent SentEvery Every Five Five Minutes Minutes • Should you export traditional NetFlow with or Every 20 Packets NetFlow Version 5 or Version 9? or 20 Packets BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 Agenda • Introduction • NetFlow Version 9 (with Traditional NetFlow) • Flexible NetFlow • NetFlow for Security • NetFlow for Application Visibility and Control • NetFlow & IPv6 • NetFlow Performance • NetFlow Standardization • Support Matrix • Conclusion BRKNMS-3132 © 2015 Cisco and/or its affiliates. All rights reserved.