Purview Integration Wireless Controller 9.21

[Michael_Kirchne]

Hi community,

has anyone integrated the wireless solution V 9.21 into Purview? I get the TopN Mirror up and running but I don't get netflow packets.

Netflow is configured in the section "VNS->Global->NetflowMirrorN"
There I configured the Mgmt IP of my Purview instance and choose esa1 as my L2 Mirror Port.

Any idea?

Best Regards
Michael

[David_Coberly]

Hello all, as soon as i enable the netflow mirror L2 port (esa1) to the purview appliance all of the wireless traffic stops. all clients are still connected to the AP's but are not able to pass traffic. NMS,NAC,Purview & WLC are virtual.. Purview configured with option 1, single interface. Any ideas?

[James_A]

Hi Peter,

While we do have Enterprise Plus vSphere, but switching to a distributed virtual switch is a big config change, so I went with the config you have above (although I assume you mean EWC not EMC). There's a few things that are covered in comments above, like using VLAN 4095 to get all data, but one thing that isn't is that you can't use the EMC to configure Wireless Controller Flow Sources, as it'll try to add both controllers of the HA pair to one capture appliance, which is exactly what you don't want. Instead, set them up manually in each EWC, and then they show up in EMC later. I also set up a DRS rule to keep the EWC and Purview VMs on the same host.

One thing I learnt while researching VMware dvSwitching is it supports Encapsulated Remote Mirroring (L3) which is a GRE port mirror. So it's conceivable that you could set that up and point it at the purview VM like you would with a CoreFlow2 GRE source. Also, now I realise I can capture normal traffic from my S4 to wireshark on my desktop.

[Peter_Chang]

Hi James. So far I implemented this yesterday, and it seems to be working. We have a vmware essentials plus license, so we can't use" distributed virtual switch". But if you have the license one above that, which I think is vmware enterprise, then you should be able to use one purview vm, and have a distributed virtual switch spanning across multiple vm hosts, for the EMC esa1 and purview etgh1 to plug into. If I remember correctly, I think this distributed virtual switch needs to be set to mirroring. This is all from what I've read, and unfortunately I can't confirm as I don't have the license.

From what I've done:
VM Host 1
-EMC1
-Analytics Purview 1 VM
-Standard Switch in promiscuous mode, using dedicated L2 port connected to our switch (EMC1 esa1, and Purview1 eth1 connected to this virtual switch)
-On our switch, I created a vlan, "analytics" to isolate traffic on this standard switch

VM Host 2
-EMC2
-Analytics Purview 2 VM
-Standard Switch in promiscuous mode (EMC2 esa1, and Purview2 eth1 connected to this virtual switch)
-On our switch, I created a vlan, "analytics2" to isolate traffic on this standard switch

On EMC1
-have netflow forward to Purview1

On EMC2
-have netflow forward to Purview 2

If you have any questions, let me know.

[James_A]

Peter: Multiple Purview VMs seems like a good idea, I'll give that a shot next week.