How to configure Netsight as IPfix collector?

[Michael_Eisensc]

Hello everyone,

I have a question concearning IPfix configuration on theNetsight. I'm currently working for a customer, who is using Netsight(ver. 7.0.6.27) to collect Netflow Traffic from Enterasys Switches, but is now planning to use Extremes Summit x460-G2 switcheswith out-of-band management. Since these switches can not use Netflow I decidedto configure IPfix instead. According to the following GTAC-Article Netsight should beable to handle IPfix:

https://extremeportal.force.com/ExtrArticleDetail?an=000082706

After I have configured the switch I noticed that there isno flow traffic displayed in OneView (Analytics>Flows). With the "show port ipfix" command I verified,that flow data is actually collected on the Switch. On the Netsight I checked with the netstat- andtcpdump-command that udp port 2075 is open and that the Netsight receives theIPfix traffic from the switch.

Since this seems to be okay I think that I either have toconfigure Netsight as an IPfix collector or that I have to adjust thedashboard.

Can someone please help?



This would be my switches ipfix configuration:

#

# Module ipfix configuration.

#

enable ip-fix

configure ip-fix domain 1

configure ip-fix ip-address 10.233.23.250 protocol udpL4-port 2075 vr "VR-Mgmt"

configure ip-fix source ip-address 10.233.26.14 vr"VR-Mgmt"

configure ip-fix ports 1-47 ingress-and-egress

enable ip-fix ports 1-47 all_traffic

Thanks in advance.

Kind regards,

Michael Eisenschmid

[Bill_Stritzinge]

Michael,

There are two ways you can handle this. The X460-G2 can generate IP-FIX flows and technically they are Netflow V.10 - with the ability to provide specific information that vendors can add up and above that of Netflow V9. Netsight can take direct flows as a collector and you can also feed a Purview engine as was suggested (and as I have outlined in previous posts on the hub - search for IPFIX and purview)

I assume you have the front side of the switch configured to Netsight, not the management port? If so the default output of IP-Fix is to the vr vr-mgmt. You have the port 2075 correct but you need to specify the vr - the command should be like this - "configure ip-fix ip-address 10.233.23.250 protocol udp L4-port 2075 vr vr-default" -- This will send flows directly to Netsight and you will see then as top talkers/top apps, etc in the dashboard almost immediately.

Give it a shot and let me know...

Bill

[Antonio_Opromol]

Hi Michael, you need to install the Extreme Analytics Application appliance and you nedd to send the ipfix traffic to this appliance. Then you add the purview collector in the OneView configuration