Avaya 4500 Series User manual

> IPFIX Technical Configuration Guide
Avaya Data Solutions
Document Date: June 10, 2010
Document Number: NN48500-595
Document Version: 2.0
Ethernet Routing Switch
4500, 5000, 8300, 8600
Engineering

Avaya Inc. –External Distribution
1
avaya.com
Abstract
This document provides configuration procedures for Protocol Flow Information eXport (IPFIX)
feature for the Ethernet Routing Switch 8600, 8300, 5000, and 4500 series as well as information
pertaining to the Avaya IP Flow Manager.
Revision Control
No
Date
Version
Revised by
Remarks
1
May 1st, 2008
1.0
PRMGT
Modifications to Software Baseline section
2
May 31st , 2010
2.0
PRMGT,
Kuntal Mondal
and Shmulik
Nehama
Additional information pertaining to ERS4500,
8300, and IP Flow Manager chapter

Avaya Inc. –External Distribution
2
avaya.com
Table of Contents
Document Updates........................................................................................................................ 3
Conventions................................................................................................................................... 3
1. Overview: Internet Protocol Flow Information eXport (IPFIX)........................................... 4
1.1 IPFIX Support on Avaya Switches................................................................................... 4
1.2 DSCP/TOS ...................................................................................................................... 6
1.3 IPFIX with Filters.............................................................................................................. 6
1.4 IPFIX Collectors............................................................................................................... 6
2. IPFIX Configuration on ERS 8600 & ERS 8300:.................................................................. 7
2.1 Enabling IPFIX globally and on a port level..................................................................... 7
2.2 Setting IPFIX timers......................................................................................................... 9
2.3 IPFIX Collector Configuration........................................................................................ 10
2.4 Using out-of-band Management with Management Virtual IP address......................... 11
3. IPFIX Configuration Examples for the ERS 8600 ............................................................. 12
3.1 IPFIX Configuration Example for the ERS 8600: .......................................................... 12
3.2 Configuring IPFIX with ACL‘s on the ERS 8600............................................................ 15
4. IPFIX Basic Configuration for ERS 5000 and ERS 4500:................................................. 18
4.1 Enabling IPFIX globally and on a port level................................................................... 18
4.2 Setting the IPFIX timers................................................................................................. 18
4.3 Adding a Collector ......................................................................................................... 19
5. IPFIX Configuration Examples for the ERS 5000 or ERS 4500 ....................................... 20
5.1 IPFIX Basic Configuration for Ethernet Routing Switch: ............................................... 20
6. Avaya’s IP Flow Manager (IPFM)........................................................................................ 22
6.1 IPFM Supported Devices............................................................................................... 22
6.2 IPFM Features and Capabilities .................................................................................... 22
6.3 IPFM Installation Tips.................................................................................................... 26
6.4 IPFM Device Configuration............................................................................................ 28
6.5 General Recommendations........................................................................................... 31
7. Software Baseline................................................................................................................ 32
8. Reference Documentation.................................................................................................. 32

Avaya Inc. –External Distribution
3
avaya.com
Document Updates
Added ERS 4500 and ERS 8300
Added Avaya IP Flow Manager (IPFM)
Conventions
This section describes the text, image, and command conventions used in this document.
Symbols:

Tip –Highlights a configuration or technical tip.

Note –Highlights important information to the reader.

Warning –Highlights important information about an action that may result in equipment
damage, configuration or data loss.
Text:
Bold text indicates emphasis.
Italic text in a Courier New font indicates text the user must enter or select in a menu item, button
or command:
ERS5520-48T# show running-config
Output examples from Avaya devices are displayed in a Lucinda Console font:
ERS5520-48T# show running-config
! Embedded ASCII Configuration Generator Script
! Model = Ethernet Routing Switch 5520-24T-PWR
! Software version = v5.0.0.011
enable
configure terminal

Avaya Inc. –External Distribution
4
avaya.com
1. Overview: Internet Protocol Flow
Information eXport (IPFIX)
Internet Protocol Flow Information eXport (IPFIX) has evolved as an improvement upon the
Netflow V9 protocol. It is a standard that has been proposed by an IETF Working Group -
http://www.ietf.org/html.charters/ipfix-charter.html. IPFIX is an effort to standardize on
architecture for IP flow measurement and export. In an IPFIX model, an exporter such as a switch
or router collects IP flows and then exports the IP flow information using a transport protocol to a
collection server or servers. An IP flow is defined as a set of packets over a period of time that
has some common properties.
1.1 IPFIX Support on Avaya Switches
Feature
ERS5000
ERS45001
ERS83002
ERS86003
Software Level
introduction
5.0
5.4
4.2
4.1
Metering and
Collecting
Yes
Collector Default
UDP Port
9995
Collector
Supported
Avaya IP Flow Manager (IPFM), NetQoS Harvester/Collector, Fluke Collector
Filters Supported
No
Yes
Number of IPFIX
Collectors
Supported
2
Exported Traffic
Protocol type
Source IP
Destination IP
Ingress port
Type-of-service byte
TCP/UDP source port
TCP/UDP destination port
Source IP
Destination IP
Protocol Type
Source protocol port
Destination protocol port
Type-of-service byte
Byte/packet count
Ingress VLAN ID
Ingress port and observation point
(VLAN or port)
Table 1: IPFIX support on ERS8600 ERS5000, and ERS4500
1 –If IPFIX is enabled, a QoS policy precedence is used

Avaya Inc. –External Distribution
5
avaya.com
2 - The switch will automatically disable IPFIX if CPU utilization exceeds 90% or if there is less than 2 Mb of system
memory available. The switch will automatically enable IPFIX again when CPU utilization returns to less than 50% or
there is 5 Mb of system memory available. The disabling and enabling of IPFIX will not affect the IPFIX configuration.
3 –Required R/RS modules, not supported on legacy modules

Avaya Inc. –External Distribution
6
avaya.com
1.2 DSCP/TOS
Please note that DSCP/TOS value collected by IPFIX depends on how a port is configured on an
Ethernet Routing Switch. For example, if a port is configured as untrusted, the TOS/DSCP value
is remarked for 0x00. Hence, all IPFIX flows collected by IPFIX will also display the appropriate
value. If filters are used to remark traffic, then IPFIX will display the DSCP/TOS value according
to how the filter or filters remark the traffic.
1.3 IPFIX with Filters
By default, IPFIX will collect all traffic as shown in table 1 above. Filters can be used with IPFIX
on the Ethernet Routing Switch 8600. This allows IPFIX to collect traffic only for specific flows
according to the traffic filter or filters configured or simply to cut down on the amount of traffic
collected. Note that this feature is not supported on the Ethernet Routing Switch 8300.
1.4 IPFIX Collectors
Collectors can be enabled or disabled on the switch. Up to two collectors are supported and if
both are enabled, the same information is sent to both collectors. Exported traffic from the switch
is in Netfow v9 format using UDP as the transport protocol using UDP port 9995. The export
interval, which specifies the interval at which updates are sent to the collector, is configurable.

Avaya Inc. –External Distribution
7
avaya.com
2. IPFIX Configuration on ERS 8600 & ERS
8300:
2.1 Enabling IPFIX globally and on a port level
To enable or disable IPFIX globally, enter the following command.
CLI:
ERS-Switch(config)# ip ipfix enable
ERS-Switch(config)# no ip ipfix enable
PPCLI:
ERS-Switch# config ip ipfix state <enable|disable>
To enable IPFIX on a port level, enter the following command:
CLI:
ERS-Switch(config)# interface < FastEthernet| GigabitEthernet> <slot/port>
ERS-Switch(config-if)# ip ipfix enable
PPCLI:
ERS-Switch# config ip ipfix port <slot|port> all-traffic enable
Additional port parameters specific to ERS 8600 and ERS 8300
CLI:
ERS8600(config-if)# ip ipfix ?
enable To enable ipfix
hash-key To set hash-key
hash-polynomial-coeffs To set hash-polynomial-coeff
hash-polynomial-seed To set hash-polynomial-seed
port Ipfix configuation on a specified port
sampling-rate To set sampling rate
ERS8300(config-if)# ip ipfix ?
enable To enable ipfix
port Ipfix configuation on a specified port
PPCLI:
ERS-8600# config ip ipfix port <slot|port> ?
Sub-Context:
Current Context:
all-traffic <enable|disable>
flush [export-and-flush]
hash-key <id>
hash-polynomial [coeffs <value>] [seed <value>]
info
sampling-rate <1-100000>

Avaya Inc. –External Distribution
8
avaya.com
ERS-8300# config ip ipfix port <slot|port>?
Sub-Context:
Current Context:
all-traffic <enable|disable>
flush [export-and-flush]
info
where:
Parameter
Description
all-traffic
Enables or disables metering on all traffic.
flush
Specifies that the records be flushed. You can export records
before flushing.
hash-key
Enter a hash-key id from 1 to 4 or hashKeyOne | hashKeyTwo
|hashKeyThree | hashKeyFour.
Hash Key 1 –Use all bits of source IP (lower 20-bits), destination
IP (lower 19-bits), Protocol (1-5 bits), Source Port (lowever 10
bits), and Destination Port (lower 10 bits).
Hash Key 2 –Use lower 20-bits of source IP, lower 19-bits of
Destination IP, and lower 24 bits of protocol (8-bits), source port
(16-bits) and destination port (16-bits)
Hash Mask 3 –Use source IP (32-bits) and destination IP (32-
bits)
Hash Mask 4 –Use source IP (32-bits), source port (16-bits) and
destination IP (16-bits)
Default setting is hashKeyOne (1).
hash-polynomial
Specifies the coefficient and seed values. Note: If you do not
specify a coefficient, the default value (0x7cc) is used. If you do
not specify a seed value, the default value (0) is used.
info
Displays current configuration.
sampling-rate
Configures the IPFIX sampling rate from 1 to 10,000 for every N
packets. The default setting is 1 for continuous monitoring.

Avaya Inc. –External Distribution
9
avaya.com
2.2 Setting IPFIX timers
CLI (same output as shown via PPCLI below):
ERS 8600
oERS-8600(config)# ip ipfix slot <slot #> ?
ERS 8300
oERS-8300(config)# ip ipfix ?
PPCLI:
ERS 8600
oERS-8600# config ip ipfix slot <slot #> ?
Sub-Context: collector
Current Context:
active-timeout <value in mins>
aging-interval <value in secs>
export-interval <value in secs>
exporter-state <enable|disable>
info
template-refresh [refresh-interval <value>] [packets <value>]
ERS 8300
oERS-8310# config ip ipfix ?
Sub-Context: collector port
Current Context:
active-timeout <value in mins>
aging-interval <value in secs>
export-interval <value in secs>
exporter-state <enable|disable>
info
state <enable|disable>
template-refresh [refresh-interval <value>] [packets <value>]
where:
Parameter
Description
active-timeout
Specifies the active timeout in minutes. Range is from 1 to 60 minutes.
aging-interval
Specifies the interval, in minutes, when to flush out the old flows after
they have stopped. Range is from 10 to 3600 seconds. Default setting
is 30 minutes.
export-interval
Specifies the interval, in seconds, between exports. Range is from 10
to 3600 seconds. Default value is 50 seconds.
exporter-state
Indicates whether IPFIX is enabled or disabled on the switch.
info
Displays configuration.

Avaya Inc. –External Distribution
10
avaya.com
template-refresh
Specifies the interval, in seconds, between refreshes and the interval,
in number of packets, between refreshes. Range for interval is 300 to
3600 seconds. Range for packets is 10,000 to 100,000.
2.3 IPFIX Collector Configuration
The following command is used to configure an IPFIX collector.
CLI:
ERS 8300
oERS-8300(config)# ip ipfix collector <ipaddr> ?
ERS 8600
oERS-8600(config)# ip ipfix collector <slot#> <ipaddr> ?
dest-port Destination port
enable State of the collector
exporter-ip Ip address of the exported traffic
protocol Type of the protocol
protocol-version Ipfix protocol version
PPCLI:
ERS 8300:
oERS-8300# config ip ipfix collector ?
ERS 8600
oERS-8600# config ip ipfix slot <slot #> collector ?
Sub-Context:
Current Context:
add <ipaddr> [protocol <value>] [dest-port <value>] [exporter-
ip <value>] [protocol-version <value>] [enable <value>]
info
remove <ipaddr>
where:
Parameter
Description
slot#
Indicates the slot for the collector.
Note: If you do not specify a slot, the command applies to all
slots.
<ipaddr>
Specifies the IP address of the collector you are adding.
protocol
Specifies the protocol to use. UDP is the default.
dest-port
Specifies the destination port.

Avaya Inc. –External Distribution
11
avaya.com
exporter-ip
Specifies the IP address of the exporter. If you do not specify
an exporter-ip, the source-ip is chosen from Virtual IP,
management IP, or outgoing interface IP based on collector-
ip reachability.
protocol-version
Selects the protocol version (ipfix|ipfixv9|preipfixv5). Default is
ipfixv9.
[enable<true|false>]
Set this to add the collector (true) or not add collectors (false).
2.4 Using out-of-band Management with Management
Virtual IP address
On the ERS8600 and ERS8300, special consideration should be used when using the out-of-
band management port on the CPU card. By default, the switch will use the out-of-band IP
address assigned to the CPU card if there is a valid route to the IPFIX Collector even if a
management virtual IP address is configured. If you have two CPU cards, two out-of-band IP
addresses will be used one for each CPU card. If a virtual management IP address is used, you
should also enabled the udpsrc-by-vip parameter so that only the management virtual IP address
will used for IPFIX packets sent to the IPFIX collector. This allows you to only have to configure
one IP address for the switch on the IPFIX collector instead of a possible two if two CPU cards
are used. The configuration is as shown below.
CLI:
ERS-Switch(config)# sys mgmt-virtual-ip <ipaddr/mask>
ERS-Switch(config)# udpsrc-by-vip
PPCLI:
ERS-Switch# config sys set mgmt-virtual-ip <ipaddr/mask>
ERS-Switch# config sys set udpsrc-by-vip enable

Avaya Inc. –External Distribution
12
avaya.com
3. IPFIX Configuration Examples for the
ERS 8600
3.1 IPFIX Configuration Example for the ERS 8600:
For this configuration example, we will configure the following:
Enable IPFIX collecting on port 7/26
Configure the IPFIX active-time to 30 seconds. This will allow viewing the IPFIX flows
on port 7/26 for up to 30 seconds.
Add an IPFIX collector which has an IP address of 172.30.30.20. We will leave the
default setting of protocol type UDP with a dst-port of 9995.
3.1.1 Configuration
To accomplish the above, please enter the following commands:
ERS 8600: Step 1 –Enable IPFIX globally
CLI:
ERS-8600(config)# ip ipfix enable
PPCLI:
ERS-8600# config ip ipfix state enable
ERS 8600: Step 2 –Enable IPFIX on port 7/26
CLI:
ERS-8600(config)# interface gigabitEthernet 7/26
ERS-8600(config-if)#ip ipfix enable
ERS-8600(config-if)# exit
PPCLI:
ERS-8600# config ip ipfix port 7/26 all-traffic enable

Avaya Inc. –External Distribution
13
avaya.com
ERS 8600: Step 3 –Change the aging timeout to 30 seconds
CLI:
ERS-8600(config)# ip ipfix slot 7 active-timeout 30
PPCLI:
ERS-8600# config ip ipfix slot 7 active-timeout 30
ERS 8600: Step 4 –Add the IPFIX Collector
CLI:
ERS-8600(config)# ip ipfix collector 7 172.30.30.20 enable
PPCLI:
ERS-8600# config ip ipfix slot 7 collector add 172.30.30.20 enable true

Avaya Inc. –External Distribution
14
avaya.com
3.1.2 Verify Operations
Step 1 –Enter the following command to display the IPFIX flows. Note that IPFIX flows will
be timed out after 30 seconds:
ERS-8600# show ip ipfix flows 7
Result:
================================================================================
IPFIX Flows
================================================================================
Slot Number : 7 Total Number Of Flows : 6
Port/ SrcIP/DstIP Src/ Protcol/ DSCP/ Start/Last SrcMac/DstMac Byte/Pkt
Vlan Addr Dst Obsv TcpFlag Time Count
Port Point
--------------------------------------------------------------------------------
7/26 198.19.1.2 1019 tcp 0 MAR 21 14:19:02 00:00:00:00:00:09 80896
500 198.19.1.1 80 Port ack MAR 21 14:19:02 00:00:00:01:00:0a 632
7/26 10.1.1.100 1024 udp 0 MAR 21 14:19:02 00:00:00:00:00:09 54016
500 10.1.1.101 69 Port none MAR 21 14:19:02 00:00:00:00:00:0a 422
7/26 198.19.1.2 1031 tcp 64 MAR 21 14:19:02 00:00:00:00:00:09 27008
500 198.19.1.1 53 Port none MAR 21 14:19:02 03:00:b0:57:00:03 211
7/26 198.19.1.2 1024 tcp 16 MAR 21 14:19:02 00:00:00:00:00:09 107776
500 198.19.1.1 21 Port none MAR 21 14:19:02 00:00:d0:01:00:09 842
7/26 198.19.1.2 1028 udp 0 MAR 21 14:19:02 00:00:00:00:00:09 80896
500 198.19.1.1 25 Port none MAR 21 14:19:02 00:0a:0b:00:00:0a 632
7/26 198.19.1.2 1036 tcp 0 MAR 21 14:19:02 00:00:00:00:00:09 161408
500 198.19.1.1 123 Port urg MAR 21 14:19:02 00:00:a0:51:00:1a 1261
Total number of Displayed Flows on Slot 7 : 6
Step 2 –To view the IPFIX collector configuration information, enter the following:
CLI:
ERS-8600# show ip ipfix collector 7
PPCLI:
ERS-8600# show ip ipfix collector-info 7
Result:
================================================================================
IPFIX Collector-Info
================================================================================
SlotNum Collector Enable Protocol Dest-Port Exporter Protocol
IP-Address State IP-Address Version
--------------------------------------------------------------------------------
7 172.30.30.20 true udp 9995 0.0.0.0 preipfixv9

Avaya Inc. –External Distribution
15
avaya.com
3.2 Configuring IPFIX with ACL’s on the ERS 8600
In configuration example 3.1, port 7/26 was setup to capture all traffic via IPFIX. In this
configuration example, we will setup IPFIX to only capture traffic based on ACL‘s. Assuming the
Ethernet Routing Switch 8600 has been configured with VLAN 500 using an IP subnet of
198.19.1.0/24, we will configure the following:
We will setup an ACL to supply IPFIX flows only for traffic with a source IP address of
198.19.1.4 from any port via VLAN 500.
*For this configuration example, we will enable the IPFIX flag at the ACE level.
Add an IPFIX collector which has an IP address of 172.30.30.20.

The Ethernet Routing Switch 8600 supports the ability to filter IPFIX flows at the ACL
(global level) level or at the ACE (individual filter) level. When setting up an ACL, you
can configure a global action to ether enable or mirror IPFIX with or without statistics.
When IPFIX is enabled at the ACL global level, IPFIX collection is applied to all ACE‘s.
If you do not enable IPFIX at the ACL global level, you can still enable IPFIX for each
individual filter at the ACE level. This will provides greater control over which ACE‘s you
wish to collect IPFIX flow on.
If you plan to use ACL with IPFIX, please do not enable IPFIX at the port level.
3.2.1 Configuration
To accomplish the above, please enter the following commands:
ERS 8600: Step 1 –Enable IPFIX globally
CLI:
ERS-8600(config)# ip ipfix enable
PPCLI:
ERS-8600# config ip ipfix state enable
ERS 8600: Step 2 –Add the IPFIX Collector
CLI:
ERS-8600(config)# ip ipfix collector 7 172.30.30.20 enable
PPCLI:
ERS-8600# config ip ipfix slot 7 collector add 172.30.30.20 enable true

Avaya Inc. –External Distribution
16
avaya.com
ERS 8600: Step 3 –Configure the Filter. For this example, we will use ACT 3 and ACL 2.
Please note that either the ACL or the ACE(s) can be configured with the IPFIX flag. If
configured at the ACL level, the IPFIX flag is global and will be applied to all ACE’s. If
configured at the ACE level, the IPFIX flag only applies to this particular ACE. For this
example, the ACE flag is configured for IPFIX.
CLI:
ERS-8600(config)# filter act 3
ERS-8600(config)# filter act 3 ip srcIp
ERS-8600(config)# filter act 3 ip srcIp
ERS-8600(config)# filter apply act 3
ERS-8600(config)# filter acl 2 type inVlan act 3
ERS-8600(config)# filter acl 2 type inVlan act 3
ERS-8600(config)# filter acl vlan 2 500
ERS-8600(config)# filter acl ace 2 1 name Src_IP
ERS-8600(config)# filter acl ace action 2 1 permit ipfix enable
ERS-8600(config)# filter acl ace ip 2 1 src-ip eq 198.19.1.4
ERS-8600(config)# filter acl ace 2 1 enable
PPCLI:
ERS-8600# config filter act 3 create
ERS-8600# config filter act 3 ip srcIp
ERS-8600# config filter act 3 apply
ERS-8600# config filter acl 2 create inVlan act 3
ERS-8600# config filter acl 2 vlan add 500
ERS-8600# config filter acl 2 ace 1 create name "Src_IP"
ERS-8600# config filter acl 2 ace 1 action permit ipfix enable
ERS-8600# config filter acl 2 ace 1 ip src-ip eq 198.19.1.4
ERS-8600# config filter acl 2 ace 1 enable

Avaya Inc. –External Distribution
17
avaya.com
3.2.2 Verify Operations
Step 1 –View IPFIX Flows:
ERS-8600# show ip ipfix flows 7
Result:
================================================================================
IPFIX Flows
================================================================================
Slot Number : 7 Total Number Of Flows : 1
Port/ SrcIP/DstIP Src/ Protcol/ DSCP/ Start/Last SrcMac/DstMac Byte/Pkt
Vlan Addr Dst Obsv TcpFlag Time Count
Port Point
--------------------------------------------------------------------------------
7/26 198.19.1.4 1231 tcp 0 APR 12 16:17:32 00:00:00:00:01:09 542092160
500 198.19.1.5 21 FiltVlan 63 APR 12 16:17:34 00:00:00:00:01:0a 4235095
Total number of Displayed Flows on Slot 7 : 1

Notice that under the Protocol column that ‗FiltVlan‘ is displayed to indicate that IPFIX
flows displayed are based on the ACL settings.

Avaya Inc. –External Distribution
18
avaya.com
4. IPFIX Basic Configuration for ERS 5000
and ERS 4500:
4.1 Enabling IPFIX globally and on a port level
To enable or disable IPFIX globally, enter the following command.
ERS-Stackable(config)# ip ipfix enable
ERS-Stackable(config)# no ip ipfix enable
To enable IPFIX on a port level, enter the following command:
ERS-Stackable(config)# interface fastEthernet <all|port #>
ERS-Stackable(config-if)# ip ipfix enable
ERS-Stackable(config-if)# ip ipfix port <port #> enable
4.2 Setting the IPFIX timers
To set the IPFIX globally, enter the following command.
ERS-Stackable(config)# ip ipfix slot ?
LINE slot list (1for standalone; 1- nfor nhigh stack)
ERS-Stackable(config)# ip ipfix slot 1 ?
aging-interval Set flow record aging interval
ERS-Stackable(config)# ip ipfix slot 1 aging-interval ?
<0-2147400> aging interval value (seconds)

Avaya Inc. –External Distribution
19
avaya.com
4.3 Adding a Collector
To add an IPFIX collector address, enter the following command. Up to two collectors can be
added.
ERS-Stackable(config)# ip ipfix collector <a.b.c.d> enable
The following commands are used to display the IPFIX flows.
ERS-Stackable# show ip ipfix table sort-by ?
byte-count Byte number
dest-addr Destination address
first-pkt-time First packet time
last-pkt-time Last packet time
pkt-count Packet number
port Port number
protocol Protocol number
source-addr Source address
TCP-UDP-dest-port TCP/UDP destination port
TCP-UDP-scr-port TCP/UDP source port
TOS TOS
ERS-Stackable# show ip ipfix table sort-by <item> sort-order
<ascending|decending> display ?
all Display all entries
top-10 Display first 10 entries
top-100 Display first 100 entries
top-200 Display first 200 entries
top-25 Display fist 25 entries
top-50 Display first 50 entries