topic Re: Which switches should we monitor with ExtremeAnalytics and what ports? in Analytics & Visibility

Which switches should we monitor with ExtremeAnalytics and what ports?

Stephen_Stormon — Fri, 30 Dec 2022 17:52:05 GMT

In each of our offices we have a x460G2 at the core and then a number of x440G2 switches uplinked to that which are used for PCs and VOIP.

At each of our colocation facilities, we have 4 x 695s and 3 x 5520s. Our external internet connects to one of the x695s, the MPLS network that connects the colos and the two offices connects to another x695, and a P2P that directly connects the colos connects to the other x695.

The 4 x 695s are all connected via a tiered MLAG setup. Should we just monitor the ports that uplink switches to another site or should we monitor all ports on all switches? We also have a number of VMware servers that I know we will need to setup the Virtual Sensor for.

Re: Which switches should we monitor with ExtremeAnalytics and what ports?

Zdeněk_Pala — Mon, 02 Jan 2023 08:32:55 GMT

Hi Stephen.

based on those switch families you mentioned I expect you are running EXOS on all those switches. I recommend enabling analytics on all ports where the traffic can enter your network. When you add the EXOS switch as a Telemetry source and your CLI credentials are working and RW then ExtremeCloud IQ - Site Engine configures the EXOS switch for you automatically. The team is working on an updated Analytics Deployment Guide, the new PDF should be available in 2nd half of February 2023. If you are interested, let me know.

Sincerely yours

Re: Which switches should we monitor with ExtremeAnalytics and what ports?

Stephen_Stormon — Mon, 02 Jan 2023 23:31:54 GMT

Yes, we are using EXOS on all the switches and we do have CLI credentials working and used Site Engine to enable telemetry on the various switches, but it enabled it on every port that is active. Taking one of our offices for example, it sounds like we only need to enable the port connected to the MPLS network. At this point, how do we now remove all of the other ports on that switch from Analytics? And what it the best way to enable Analytics on the other switches via Site Engine without enabling it on all active ports?

Re: Which switches should we monitor with ExtremeAnalytics and what ports?

Zdeněk_Pala — Tue, 03 Jan 2023 13:15:23 GMT

Please elaborate why do you want to disable analytics on some ports?

The Analytics Engine must see both directions of the flow. The switch sends only ingress traffic to the Analytics Engine. If the other direction of the traffic is received from other switch then the result is sub-optimal. There is some enhancement is planned for 23.2.10 release.

It is recommended to enable Extreme Analytics on all ports.

Re: Which switches should we monitor with ExtremeAnalytics and what ports?

Zdeněk_Pala — Tue, 03 Jan 2023 13:17:46 GMT

On the EXOS there are two pieces configured for ExtremeAnalytics:

ACL = telemetry.pol
sFlow

If some ports needs to be excluded then both (ACL and sFLow) should be modified. But as mentioned the result will be suboptimal.

Re: Which switches should we monitor with ExtremeAnalytics and what ports?

Stephen_Stormon — Wed, 04 Jan 2023 17:16:08 GMT

I read your initial comment of "I recommend enabling analytics on all ports where the traffic can enter your network" to mean that we only needed to enable Analytics on the ports connected to our MPLS network and infrastructure (entering our network between sites) and not as "entering the network" from anywhere like a PC or server connected to the network.

So enable it on all ports on all switches? For example in our one office, we have the core switch which uplinks to a desktop switch stack and a VoIP switch stack. So we want Analytics enabled on all ports on all of those or just the core?

Is there any benefit/need to also install the Virtual Sensor on our VMware servers if we already have analytics enabled on every switch port?

Re: Which switches should we monitor with ExtremeAnalytics and what ports?

Zdeněk_Pala — Thu, 05 Jan 2023 13:21:00 GMT

Topology: Switch X is connected to Switch Y

Scenario A: enable analytics on Switch X only

PLUS: Analytics will see traffic passing switch X
MINUS: Analytics will not see traffic local to switch Y

Scenario B: enable analytics on both Switch X and Y

PLUS: Analytics will see all traffic
MINUS: traffic passing both switches will be processed twice (higher CPU), but deduplication happens the result is correct as long as both switch X and Y are processed by the same Analytics Engines

Scenario C: enable analytics on edge ports of Switch X and Y = exclude inter-switch links.

PLUS: little lower overhead on the network
MINUS: the minimum version XIQ-SE 23.2.10 and enable Fabric Mode on the analytics engine.
MINUS: manual configuration of the switch (disable the analytics on the inter-switch links

For EXOS the recommendation/best practice is Scenario B.

Regarding the Virtual Sensor:

Virtual Sensor was a paid component
Virtual Sensor was not a successful product and is end-of-sales already

Re: Which switches should we monitor with ExtremeAnalytics and what ports?

Stephen_Stormon — Wed, 25 Jan 2023 22:41:58 GMT

Thank you for the clarification. I tried adding more of our switches but what of them is giving this error which I am not sure what to do about.

An error has occurred while adding a telemetry source to the selected engine. The switch's ACLs may be fully utilized due to other switch policy. You can use the EXOS "show access-list" command to investigate. See below for an error message from the EXOS device.

Re: Which switches should we monitor with ExtremeAnalytics and what ports?

Zdeněk_Pala — Thu, 26 Jan 2023 17:20:02 GMT

Every switch HW has some limitations in the ASIC chip. The premium edge devices have more ACL space compare to non-premium devices.

You can try the command "configure policy resource-profile" to limit the resource allocation made by policy.

You can modify the telemetry.pol file to limit the analytics.

I hope it helps. Good luck.