Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

AppVis™ and Flow - Configuration

Overview

This page shows sample device configuration for AppVis™ (Cisco only) and Flow (a sequence of packets from a source computer to a destination. Highlight Flow reports on the top 20 flows by volume for a given time period, using IP address and port numbers) (IPFIX, Netflow and J-Flow).

Configuration for NBAR (Network-Based Application Recognition - mechanism used by Cisco devices to recognise applications, packets are inspected using DPI (Deep Packet Inspection)) on Cisco routers is also available. Details are on the NBAR configuration page.

AppVis/Flow can cause a high CPU load so the monitored device needs to be adequately sized for the volume of traffic expected at each location.

AppVis™

AppVis is only supported for Cisco routers, and each router:

  • should have an NBAR2 protocol pack licensed and installed

    Note: NBAR2 is not a pre-requisite for AppVis which could use standard NBAR classification. However standard NBAR has significantly fewer signatures than NBAR2 so AppVis would be less granular in the information it reports. Licence details are available from Reporting inventory

  • must have Flexible Netflow configured. An example configuration follows:

    Note: existing Flow configuration for version 5 or version 9 should be removed from the router first

flow exporter highlight-exporter
  description the fields to be used in the export packet header
  destination **IP address of Collector**
  source **interface that matches IP address in Highlight**
  transport udp 9996
!
flow record highlight-appvis
  description the fields to be sent in the individual flow records in a flow packet
  match ipv4 tos
  match ipv4 protocol
  match ipv4 source address
  match ipv4 destination address
  match transport source-port
  match transport destination-port
  match interface input
  match interface output
  match application name
  collect counter bytes
  collect counter packets
!
flow monitor highlight-monitor
  description the exporter/record combination to be applied to interfaces for flow collection
  exporter highlight-exporter
  record highlight-appvis

And on the interface to be monitored for Flow

If the WAN interface carries only encrypted or encapsulated traffic, the LAN interface should be configured for AppVis Flow. Also, ensure the Flow exporter source address is not NATed.

Cisco NetFlow

Set out below are details of the Cisco IOS commands needed for Highlight to report Flow information, and a description of their function. See below for the equivalent Juniper commands.

The Flow configuration:

  • specifies the Flow version (version 9 recommended if available; version 5 is also supported)

  • defines the destination address of the NetFlow collector (a Highlight Agent)

  • specifies the interface on the device that has the source IP address used to send Flow packets to the Flow collector

Some Cisco devices may only support Flexible NetFlow configuration, please see below for the Flexible NetFlow configuration.

Flow version 9 configuration

Then on the monitored interface

Flow version 5 configuration

Then on ALL interfaces carrying traffic

Additional configuration

In addition to configuring Flow settings, it is recommended interface persistence is also added to avoid loss of Flow monitoring if the interface numbering changes.

Cisco Flexible NetFlow

Highlight can support Flexible NetFlow using the 'Legacy' template only. This is an alternative to the configuration defined previously and both configurations should not be deployed together.

And on the interface to be monitored for Flow

Additional configuration

In addition to configuring Flow settings, it is recommended interface persistence is also added to avoid loss of Flow monitoring if the interface numbering changes.

Juniper J-Flow

Set out below are details of the Juniper commands needed for Highlight to report J-Flow information.

Assuming ge-0/0/0 to be your interface for flow analysis:

For a sampling rate of 1 in n packets. Use n=1 for all packets to be analysed

For a Flow Collector with IP address nnn.nnn.nnn.nnn

The Juniper interface selected in Highlight for Flow analysis should be the ".0" sub-interface. For the example above, select ge-0/0/0.0 in Highlight.

FortiGate Firewall

Set out below is a summary of the FortiGate commands needed to report NetFlow information in Highlight.

Details have been extracted from this Fortinet technical page.

For a Flow Collector with IP address nnn.nnn.nnn.nnn:

Then add Flow to the monitored interface:

If wishing to monitor a WAN interface with PPPoE but it fails to report, try configuring the LAN interface for monitoring, and use "Swap I/O" in the Highlight watch configuration.

Related

PreviousCisco Webex Bot Token GuideNextNBAR - Device Configuration

Was this helpful?