Wanguard 6.2 User Guide
Configuration » Components » Flow Sensor
✔
When you define interfaces with the
Traffic Direction
parameter set to “Auto”, make sure that the IP
Zone you have selected for the Flow Sensor contains all your IP blocks.
✔
In order to provide fast and up-to-date traffic statistics, the Flow Sensor accepts only flows describing
traffic from the last 5 minutes. All flows aged and exported with a delay exceeding 300 seconds (5
minutes) are ignored, and the event log contains the warning “
Received flow <starting/ending> <X>
seconds ago
”.
When the warnings refer to the starting time, make sure that the clocks are synchronized, the flow
exporter is properly configured, and the time zone and the
Flow Timeout
parameter are correctly set.
When the warnings refer to the ending time, make sure that the clocks are synchronized, the time zone
is correctly set and the flow exporter is properly configured.
You can double-check whether the time of the Flow Sensor and the start/end time of flows differ by
more than 300 seconds. In Reports » Tools » Flow Collectors » Flow Records, select the Flow Sensor, set
Output to Debug and generate a listing for the last 5 minutes:
◦
The Date_flow_received column indicates the time when the Flow Sensor received the flow packet
◦
The Date_first_seen column indicates the time when the flow started
◦
The Date_last_seen column indicates the time when the flow ended
The Flow Sensor does not misinterpret the start/end time of flows. A few flow exporters are known to
have bugs, limitations or inconsistencies regarding flow aging and stamping flow packets with the
correct time. In this case, contact your vendor to make sure that the flow exporter is correctly
configured, and it is able to expire flows in under 5 minutes. Try a router reboot if possible.
In JunOS there is a flow export rate limit with a default of 1k pps, which leads to flow aging errors. To
raise the limit to 40k pps execute:
set forwarding-options sampling instance NETFLOW family inet output inline-jflow
flow-export-rate 40
Some Cisco IOS XE devices do not export flows using NetFlow version 5, in under 5 minutes, even when
configured to do so. In this case, switch to using Flexible NetFlow.
✔
Ensure that you have correctly configured the flow exporter to send flows to the server for each of the
monitored interfaces. To list all interfaces that send flows, go to Reports » Tools » Flow Collectors » Flow
Tops, select the Flow Sensor, set Output to Debug, set Top Type to Any Interface and generate the top
for the last 10 minutes. The In/Out_If column shows the SNMP index of every interface that exports
flows, whether or not it was configured as a monitored interface in the Flow Sensor configuration.
✔
If you see statistics for only one traffic direction (inbound or outbound), go to Reports » Tools » Flow
Collectors » Flow Records, and generate a listing for the last 10 minutes. If all your IPs are listed in a
single column, check the flow exporter's configuration and feature list. Not all devices can export flows
in both directions (e.g. some Brocade equipment generates only inbound sFlow) or with the same
interface SNMP index.
✔
The traffic readings of the Flow Sensor may differ from the SNMP Sensor or from other SNMP-based
monitoring tools. Flow Sensor counts In/Out traffic as traffic entering/exiting the IP Zone (when
IP
Validation
is enabled), unlike SNMP tools that count In/Out traffic as traffic entering/exiting the
interface. You can double-check the traffic readings of a Flow Sensor by configuring an SNMP Sensor
that monitors the same flow exporter (page 47).
✔
If the Flow Sensor does not show the correct statistics after upgrading the router's firmware, the SNMP
index of the interfaces may have changed. In this case, enter the new SNMP index for each monitored
- 45 -
Summary of Contents for wanguard 6.2
Page 1: ......
