topic Re: Filter a specific server or port out of Extreme Analytics? in Analytics & Visibility

Filter a specific server or port out of Extreme Analytics?

Stephen_Stormon — Thu, 09 Mar 2023 20:52:32 GMT

We have two x695 switches running XOS 31.7.1.4 31.7.1.4-patch1-36. We opened a case to see if there was a way to disable analytics on a specific port and were told that it can be done but is not officially supported. The port in question is the external side of our firewall and it is generating a lot of traffic that fills up the logs (and causes concern even the firewall is blocking the traffic). We tried the unofficial steps of trying to remove the port from telemetry but that failed (below)

* Summit-BTP-x695-01.12 # configure access-list telemetry ports 1-15,17-62 ingress

Error: ACL install operation failed - filter hardware full for vlan *, port 62

Is there any way in Analytics to filter out a specific port or IP from being displayed in the Application Flows?

Re: Filter a specific server or port out of Extreme Analytics?

Ryan_Yacobucci — Sat, 11 Mar 2023 18:34:23 GMT

Hello,

You can try this:
Analytics > Configuration > Select specific Engine > Configuration > Configuration Properties > Add NAME = “options.FlowServerOptions.flowCollectorFilter” (see below)

NAME = options.FlowServerOptions.flowCollectorFilter
VALUE (example) = sip=10.3.0.0/16,exclude;dip=10.3.0.0/16,exclude;sip=10.5.0.0/16,exclude;dip=10.5.0.0/16,exclude

You should be able to use this to exclude traffic.

Thanks
-Ryan

Re: Filter a specific server or port out of Extreme Analytics?

Stephen_Stormon — Mon, 13 Mar 2023 11:11:52 GMT

I'm not seeing a "Configuration properties" option unless I'm totally missing it. We are on version 23.2.10.82.

Re: Filter a specific server or port out of Extreme Analytics?

Ryan_Yacobucci — Mon, 13 Mar 2023 12:18:36 GMT

Re: Filter a specific server or port out of Extreme Analytics?

Stephen_Stormon — Tue, 14 Mar 2023 12:52:31 GMT

Thanks, I definitely missed that. I put in a filter but is doesn't seem to be working as I am still seeing the traffic. Is there a FlowCollectorFilter to exclude traffic on specific ports of a switch?

Re: Filter a specific server or port out of Extreme Analytics?

Stephen_Stormon — Fri, 17 Mar 2023 15:32:59 GMT

I realized that I was misunderstanding the filters and needed to make two rules (sip=0.0.0.0/0,exclude:dip=144.202.238.155/32 and sip=144.202.238.155/32,exclude:dip=0.0.0.0/0).

However, if we could filter out specific switch ports, that would be ideal for what we are looking to do.