Q. What is the Cisco
® 6500 Series and Cisco 7600 Series Network Analysis Module (NAM) and what does it do?
A. The Cisco Catalyst 6500 Series and Cisco 7600 Series NAM is an integrated traffic and performance analysis blade that empowers network administrators to quickly understand how traffic over the network is being used and how it is performing to troubleshoot performance issues and help ensure a consistent end-user experience. Its unique design combines a rich set of embedded data collection and analysis capabilities with a remotely accessible, web-based management console, all of which reside on a single blade that is installed into the Cisco Catalyst 6500 Series Switch or the Cisco 7600 Series Router.
The Cisco NAM with Software 5.0 includes an embedded, intuitive web-based graphical user interface (GUI) with prepackaged reports, workflows, and contextual navigation to expedite problem resolution and optimization decisions. It also includes a new Performance Database that preserves historical data, allowing you to understand what happened in the past when an event that affected network performance occurred. Other NAM 5.0 innovations are highlighted in the NAM 5.0 section of this document.
Q. What are the key features and benefits of the Cisco NAM?
A. The key features and benefits of the Cisco NAM are provided in Table 1.
Table 1. Key Features and Benefits of the Cisco NAM
Performance assurance integrated in the switch/router
Deployed in the Cisco Catalyst 6500 Series Switch and the Cisco 7600 Router, the Cisco NAM provides greater investment protection, lower total cost of ownership, and reduced footprint to save premium rack space.
Intelligent application performance metrics
Analyze transaction-aware analytics to help characterize the end-user experience and isolate application response time problems to the network, server, or the application itself.
Comprehensive voice quality monitoring
View Mean Opinion Score (MOS) along with key performance metrics for each Real Time Protocol (RTP) stream to help ensure delivery of committed service levels to the end user.
Takes you back to the past using the Cisco NAM's Performance Database to understand what happened when an event that affected network performance occurred. It supports historical data analysis to accelerate problem resolution and advance optimization decisions.
Visibility into WAN-optimized networks
Obtain end-to-end proof points demonstrating how Cisco Wide Area Application Services (WAAS) has improved application delivery. NAM reports on application response time, WAN bandwidth usage, LAN/WAN data throughput, and many other metrics to help ensure effective use of Cisco WAAS.
Monitoring virtual machine (VM) network traffic
Extends operational visibility to the virtual switching layer with Cisco Nexus 1000V switch deployments. Offers insight into VM-to-VM interactions, virtual network traffic behavior, and virtual interface statistics. Monitors the VMs un-interrupted by VM migration.
Granular flow- and packet-based traffic analytics
View short- and long-term performance data on hosts, conversations, and applications that use critical network resources.
LAN and WAN monitoring in one solution
Gain visibility into traffic from local and remote switches and routers for comprehensive traffic monitoring.
Web-based captures for deep, insightful data analysis
Capture the packets to help resolve acute problems before they affect users. Perform captures using a web browser from any desktop, and view packet capture decodes through the Traffic Analyzer GUI while the data is still being captured. Quickly pinpoint and resolve problem areas using trigger-based captures, decodes, filters, and packet capture error scan.
Visibility into Virtual Switch System (VSS) deployments
Monitor both virtual switches in VSS environments, reducing management overhead while improving operational efficiency.
Pre- and postdeployment metrics
Glean valuable before and after traffic analytics to help plan for and verify changes in network resources, such as introducing new applications, establishing quality of service (QoS) policies, consolidating servers, and deploying voice over IP (VoIP).
Use TACACS+, Secure Sockets Layer (SSL), and Secure Shell (SSH) Protocol - based security.
Standards-based northbound interface
Ease NAM configuration and export of computed NAM data using standards-based APIs (REST/XML for configuration, NetFlow Version 9 for data export). Facilitates integration with customer in-house managed applications or third-party reporting application of choice.
Anytime, anywhere access
Access the embedded Traffic Analyzer web interface from any desktop, eliminating the need to send personnel to remote sites or haul large amounts of data over WAN links to the central site.
Cisco NAM can be deployed in blade form factor in Cisco Catalyst 6500 Series Switches, Cisco 7600 Series Routers, and Cisco Integrated Services Routers as multigigabit appliances, and as virtual service blades residing directly on WAAS devices or on the Nexus 1010 Virtual Service Appliance. The complement of physical and virtual blades and of appliances allows NAM instrumentation to be broadly deployed in the network for comprehensive performance monitoring.
Q. What are the business benefits of deploying Cisco NAM?
A. Table 2 provides an overview of the business benefits that Cisco NAM offers.
Table 2. Business Benefits of Deploying Cisco NAM
Improve operational efficiency with faster problem resolution and greater productivity
• Rapid problem isolation with prepackaged reports, visual correlation, contextual navigation, and one-click packet captures
• Combined packet and flow analysis reduces time to noteworthy and actionable information to expedite troubleshooting
• Remote management eliminates the need to travel to remote sites
Enhance service levels with consistent application performance visibility across the network
• Accurate characterization of performance with advanced analytics for voice and TCP applications
• Consistent application recognition using new application classification architecture
• Improved end-user experience with effective use of control and optimization techniques such as QoS and Cisco WAAS
• Preemption of performance issues with threshold-based proactive alerts reduces downtime and failures
Reduce total cost of ownership
• Integrated with Cisco platforms, NAM delivers reduced network footprint, lower operational cost, and simplified manageability
• NAM form factors offer cost-effective options and deployment flexibility to address location-specific network instrumentation needs
• Open standards-based API preserves investment in existing management assets
Q. What is the difference between NAM-1 and NAM-2?
A. NAM-1 and NAM-2 share the same hardware architecture and software applications, but differ in the following ways:
• NAM-2 has an additional accelerator card that provides extra high packet processing performance to monitor gigabit bandwidth.
• With NAM Software 3.1 or later, NAM-2 includes two data ports to support Switched Port Analyzer (SPAN)/VLAN Access Control List (VACL) traffic, whereas NAM-1 includes one data port only. With the second data port, the NAM-2 can receive two SPAN sessions, two VACL-based captures, or one of each data source. The SPAN sessions, each consisting of multiple ports, VLANs, or EtherChannel connections, can be used independently or together. This feature allows users to view traffic on each side of a full-duplex trunk or to dedicate one data port for troubleshooting and the other data port for reporting.
• NAM-2 has a larger capture buffer than NAM-1. The buffer capacity of NAM-2 (WS-SVC-NAM-2-250S) is 500 MB and NAM-1 (WS-SVC-NAM-1-250S) is 200 MB.
Q. Is the NAM-1 upgradeable to NAM-2?
A. No. NAM-1 and NAM-2 have fixed configurations and cannot be transformed from one version to the other.
Q. What is the Cisco NAM Traffic Analyzer?
A. The Cisco NAM includes the embedded Traffic Analyzer application, which offers an intuitive, web-based GUI with prepackaged reports, workflows, and contextual navigation to expedite problem resolution and optimization decisions. It provides quick access to the configuration menus and interactive reports on the performance of voice, video, and TCP-based traffic. In addition, the Traffic Analyzer application hosts an embedded web server that enables remote access from anywhere so that network performance can be viewed, managed, and improved at any time, eliminating the need to travel to remote sites or haul large amounts of data over WAN links to a central site.
Q. What supervisor operating systems does the Cisco NAM support?
A. The Cisco NAM is compatible with supervisors running Cisco Catalyst OS and Cisco IOS
® Software. Please refer to the Cisco NAM Release Notes for specific versions of the Catalyst OS and Cisco IOS Software supported on the NAM for the Cisco Catalyst 6500 Series Switches and for the Cisco 7600 Series Routers.
Q. Where is the Cisco NAM deployed in the network?
A. The Cisco NAM is deployed in the Cisco Catalyst 6500 Series at LAN aggregation points (for example, in the core or distribution layer) for monitoring and quick troubleshooting; at service points (for example, in data centers, server farms, or Cisco Unified Communications Manager clusters) where performance is critical; and at critical access points. Also, the NAM can be deployed in Cisco 7600 Series Routers at WAN edges or in Catalyst 6500 Series Switches connected to WAN routers. When deployed at remote sites, the Cisco NAM uniquely allows users to perform remote troubleshooting and traffic analysis using the embedded web-based Traffic Analyzer without having to send personnel or to haul large amounts of data to the central site. When deployed in the data center server access, the Cisco NAM can also be used for monitoring traffic in the virtual machine network, extending the visibility into the virtual infrastructure with Cisco Nexus 1000V switch deployments.
Q. In what release were the upgraded NAM-1 (WS-SVC-NAM-1-250S) and NAM-2 (WS-SVC-NAM-2-250S) first introduced?
A. The upgraded NAM-1 and NAM-2 were first introduced in NAM 3.6.1b.
Q. What do the upgraded NAMs offer?
A. The upgraded NAMs offer higher memory (DRAM) and larger onboard storage. The higher memory optimizes the performance of the NAM software. The disk drive upgrade offers larger capacity to permit the storage of more reports and captures.
Latest Release: NAM Software 5.0
Q. What key innovations does NAM Software 5.0 offer?
A. The key Cisco NAM 5.0 innovations are described in Table 3.
Table 3. New Features in Cisco NAM Software 5.0
Reinspired user experience
NAM Software 5.0 introduces a next-generation GUI that helps accelerate troubleshooting and optimization decisions by providing access to critical information at your fingertips. It offers preconfigured dashboards to give you a comprehensive graphical overview of network performance. It also includes prepackaged interactive reports with helpful features such as contextual navigation, advanced filters, and one-click packet captures. The new GUI reduces not only the time it takes to solve problems but also the time it takes to learn the product, giving you more time to spend on advancing new business initiatives.
Flexible site-based monitoring
This feature allows you to view network and application performance by logical groupings or sites that you can create to mirror your network topology. For example, you can create sites by geographic locations, departments, or even managed customer networks and view performance data on a per site basis making it easier to obtain both a global and local view of how your applications are performing.
Historical analysis with embedded Performance Database
The Cisco NAM's new Performance Database stores computed data so you can go back to the past to troubleshoot unanticipated performance issues or to analyze optimization needs.
Prepackaged analysis workflows
Pre-packaged workflows help streamline and accelerate problem resolution. Not only do they improve the operational efficiency, they also validate and improve optimization decisions.
NetFlow and packet data analysis in one box
NetFlow and packet data complement each other to provide a powerful monitoring solution, all in one box. With expanded NetFlow reporting capabilities, you can obtain an extensive view of the traffic to see who is using your network, what applications they're using, and how much bandwidth is being consumed. Pinpointing traffic of interest, you can use packet-based data to perform a "deeper dive" to quickly spot and address issues that affect performance.
NBAR-based application recognition
The Cisco NAM now supports standardized application identifiers generated by Network-based Application Recognition (NBAR) to help deliver consistency to application recognition across the network.
Packet Capture Error Scan
The new Packet Capture Error Scan automatically highlights packet-level anomalies to accelerate root-cause analysis and avoid having manually to inspect the packet data to find the "needle in the haystack."
NetFlow Version 9 Data Export
By exporting analytics in a standardized format, this new capability allows you to use computed NAM data to feed in-house or third-party reporting applications that you already own, building up additional value and building out existing investments.
Q. When is NAM Software 5.0 available?
A. Starting at the end of January 2011, current Cisco NAM customers can download Cisco NAM Software 5.0 from the Cisco.com Software Center at no charge using their Cisco SMARTnet
® contract access privileges. NAM 5.0 is available in February 2011 as part of NAM blade orders.
Q. Which NAM hardware platforms support NAM Software 5.0?
A. NAM Software 5.0 is supported on the hardware platforms listed in Table 4. All of the platforms in the list include a minimum of 1 GB memory. NAM 5.0 requires that the platform include this minimum. In addition, the platforms marked by an asterisk (*) include memory configurations above the 1 GB minimum. These memory configurations optimize NAM 5.0 performance.
Table 4. NAM Hardware Platforms Supported with NAM 5.0 Software
Hardware Part Number
Cisco NAM 2200 Series Appliances
Cisco Catalyst 6500 Series and Cisco 7600 Series NAM-1
WS-SVC-NAM-1 with MEM-C6KNAM-2GB=*
Cisco Catalyst 6500 Series and Cisco 7600 Series NAM-2
WS-SVC-NAM-2 with MEM-C6KNAM-2GB=*
Cisco Branch Routers Series NAM
Q. If the NAM platform that I have is not supported, what options exist to allow me to use NAM 5.0 Software?
A. As indicated in the answer above, NAM Software 5.0 is supported on NAM hardware platforms that include at least 1 GB of memory. If you have either of the two end-of-sale NAM hardware platforms indicated below that include less than 1 GB of memory, Cisco recommends the following:
• For WS-SVC-NAM-1 (Cisco Catalyst 6500 Series NAM-1): Consider upgrading the memory to 2 GB by purchasing the field-installable Cisco Catalyst 6500 Series NAM-1 and NAM-2 Memory Upgrade Kit, MEM-C6KNAM-2GB=.
• For NME-NAM-80S (Cisco Branch Routers Series NAM): Consider taking advantage of the Cisco Technical Migration Program (CTMP) to trade-in your NME-NAM-80S NAM for a NME-NAM-120S NAM and protect your existing investment. The -120S NAM platform, which replaces the -80S, is available on supported Cisco ISR and ISR G2 routers.
Q. How do the NAM 5.0 features benefit Cisco Catalyst 6500 NAM users?
A. NAM Software 5.0 helps enable you to get critical network information at your fingertips. Whether you are responding to a help desk call on slow application performance, understanding application performance or traffic behavior before and after deploying technologies such as Cisco WAAS or Cisco Catalyst 6500 VSS, or learning whether application performance has also made the leap with your migration from physical servers to virtual machines, it accelerates performance troubleshooting process and network resource optimization decisions for cost-effective service delivery. The Cisco Catalyst 6500 NAM users can take advantage of all the new features listed in Table 3.
Q. Will I be able to perform a software upgrade from NAM 4.x to NAM 5.0 or do I need to freshly install NAM Software 5.0?
A. NAM Software 5.0 introduces a new embedded performance database and a new internal data schema. As a result, a fresh install is needed.
Q. Will I lose any data when I migrate from NAM 4.x to NAM Software 5.0?
A. Since NAM software 5.0 introduces a new "backend", installing NAM Software 5.0 will result in loss of data and configuration settings. The configuration settings can be exported prior to upgrade and reimported after the upgrade to minimize the loss. The "config upload" and "config network" commands to perform these tasks are documented in the command reference guide. Note that some of the configuration settings are no longer applicable.
Q. How does the Cisco NAM with Software 5.0 work?
A. The Cisco NAM collects packets or flows (NetFlow Data Export [NDE]) being sent to it from the switch or router. The NAM parses the packets, gathers relevant data and stores processed information in the new Performance Database. This database provides valuable traffic information on voice, video, and data traffic, VLANs, Differentiated Services (DiffServ) configurations, hosts, conversation pairs, application usage, and application response times. This information is presented in the NAM's Traffic Analyzer GUI in easy-to-read interactive reports.
The packets that the Cisco NAM collects are defined by the user's selecting one or more data sources. Data sources, which are features of the switch, router, or WAAS device, are described in Table 5. The Cisco NAM has independent backplane interfaces to collect SPAN/VACL traffic and NDE/WAAS/ERSPAN.
Table 5. Cisco Catalyst 6500 Series and Cisco 7600 Series NAM Traffic Sources
SPAN, Remote SPAN (RSPAN), and Encapsulated RSPAN (ERSPAN)
Using the SPAN, RSPAN, and ERSPAN capabilities of Cisco Catalyst 6500 Series Switches, traffic from ports, VLANs, and EtherChannel links can be mirrored to the NAM. The NAM collects statistics on all layers of network traffic spanned to it. RSPAN allows traffic to be collected from other RSPAN-enabled devices in the same VLAN Trunk Protocol (VTP) domain. ERSPAN allows traffic to be sent to the NAM using generic routing encapsulation (GRE) tunnels from a Layer 3 network.
The NAM uses VACLs to capture or "filter" selected VLANs and WAN traffic (on Cisco IOS devices only) to the NAM ports. Additional filtering rules can also be applied to target specific data flows. The NAM must be specified as the capture destination for VACL entries when configuring the local supervisor.
NetFlow Data Export records offer an aggregate view of the network traffic. When enabled on the switch, the NetFlow data source becomes available on the Cisco NAM without the need to create any SPAN sessions. In addition, the NAM can receive NDE from remote devices for analysis.
The NAM uses the built-in instrumentation on WAAS to gather information about the optimized and pass-through traffic to provide end-to-end application performance visibility in a Cisco WAAS environment. The information allows NAM to measure application response time, transaction time, bandwidth usage, and LAN/WAN data throughput to accurately quantify the impact of Cisco WAAS optimizations.
Q. How does the Cisco NAM gain visibility into traffic from other switches/routers?
A. The LAN or WAN traffic from other devices can be directed to the NAM for analysis using RSPAN, ERSPAN, or NetFlow Data Exports.
Q. How does the Cisco NAM gain visibility into WAN traffic?
A. The NAM gains visibility into WAN traffic using VACL capture for WAN interfaces and NDE. VACL-based captures can be used (in supervisors running Cisco IOS Software in native mode) to monitor traffic from WAN interfaces. NDE from local and remote devices can be used to monitor WAN interfaces and provide application-level visibility into WAN segments.
Q. What is VACL capture and how does the Cisco NAM use it?
A. VACL capture is a data source that uses SPAN and fulfills similar functions. VACLs can be used to capture or "filter" selected VLANs and WAN traffic (with Cisco IOS Software). In Cisco IOS Software 12.2(18)SXF or later, VACLs can also be applied to WAN interfaces.
Q. How does the Cisco NAM with Software 5.0 use NetFlow?
A. The Cisco NAM supports monitoring of both packet- and NetFlow-based traffic sources using independent backplane interfaces. These two data sources complement each other to provide a powerful and comprehensive monitoring solution. NetFlow can be used to gain an extensive view of the traffic to analyze who is using your network, what applications they're using, and how much bandwidth is being consumed. For deeper analysis, it can be combined with packet data using traffic sources such as SPAN, VACL, ERSPAN, or RSPAN. Also, NetFlow can be used to obtain visibility into traffic where SPAN is not available (for example, WAN interfaces, remote router interfaces, and so on).
NetFlow can be enabled on interfaces of local or remote devices and sent to the NAM for analysis. As a consumer, the NAM can receive NetFlow packets on its management port from devices such as Cisco routers and switches. Those records are stored in its performance database as if that traffic had appeared on one of the NAM data ports. The NAM understands NetFlow versions 1, 5, 6, 7, 8, and 9. Incoming NetFlow data is parsed by the NAM, stored in its internal database, and presented in the GUI in the same way as traffic from other data sources.
Some network devices have more than one "engine" that is capable of independently exporting NetFlow. Depending upon features of the device, flows can be exported from multiple flow caches in the hardware and/or software. For example, supervisor and line cards may be able to export flows independently from their local caches. By default, NAM 5.0 will automatically create independent data sources for each engine exporting NetFlow records to NAM.
Q. Can the Cisco NAM collect NetFlow from remote WAN routers?
A. Yes. The Cisco NAM can collect and analyze NDE from remote devices including WAN routers. This feature is helpful in analyzing traffic on a WAN router connected to the Catalyst 6500 Series Switch or from remote WAN routers where ample bandwidth is available to send NDE.
Q. Does the Cisco NAM require a separate NetFlow data collector for monitoring?
A. No. The NAM collects and consumes NetFlow data for performance monitoring purposes.
Q. What versions of NetFlow does the Cisco Catalyst 6500 Series and Cisco 7600 Series NAM support?
A. The NAM supports versions 1, 5, 6, 7, 8, and 9.
Q. What release of Cisco IOS Software is required to support the Cisco Catalyst 6500 Series and Cisco 7600 Series NAM?
A. The Cisco NAM requires any feature license in Cisco IOS Software Release 12.2(18)SXF (or later) or Cisco Catalyst Operating System 8.2(1) (or later). Please refer to the Cisco NAM Release Notes for extensive information on the required system software.
Q. How is the Cisco NAM Traffic Analyzer secured?
A. The Cisco NAM Traffic Analyzer can be secured with up to 256-bit encryption. The NAM also supports role-based user authorization and authentication locally or using TACACS+.
Q. Can NAM-1 or NAM-2 be deployed in fabric-enabled Cisco Catalyst 6500 Switches or Cisco 7600 Series without affecting switch performance?
A. Yes. NAM-1 and NAM-2 support full fabric (crossbar) connectivity and can be deployed in a fabric-enabled chassis with no impact on switching performance.
Q. Can multiple Cisco NAMs be installed in a Cisco Catalyst 6500 Series or Cisco 7600 Series chassis?
A. Yes. Multiple Cisco NAMs can be installed in a single chassis.
Q. Can the Cisco NAM be installed in a Cisco Catalyst 6500 Series or Cisco 7600 Series chassis with other services modules (for example, the Firewall Services Module [FWSM])?
A. Yes. The Cisco NAM can be installed with other services modules.
Q. Are there any ports or network interfaces on the Cisco NAM?
Q. Can multiple VLANs be spanned to the Cisco NAM?
A. Yes. The NAM is fully compatible with the SMON MIB and supports the monitoring of multiple VLANs.
Q. Does the Cisco NAM support supervisor failover?
Q. If a switch chassis is upgraded, must a new Cisco NAM be purchased?
A. No. The Cisco NAM is fully functional in any of the modular Cisco Catalyst 6500 or 6000 Series chassis and Cisco 7600 Series chassis.
Q. Does the NAM support Virtual Switch System on the Catalyst 6500?
A. Yes, all Catalyst 6500 NAMs and NAM Appliances support VSS.
Q. Which NAM and Cisco IOS Software releases support VSS?
A. On the Catalyst 6500 NAM-1 and NAM-2, VSS is supported in NAM 3.6.1a or later with Cisco IOS Software Release 12.2(33)SXH(1) or later. On the Catalyst 6500 NAM-1-250S and NAM-2-250S, VSS is supported in NAM 3.6.1b or later with Cisco IOS Software Release 12.2(33)SXH(1) or later. On the NAM Appliances, VSS is supported in NAM 4.0 or later with Cisco IOS Software Release 12.2(33)SXH(1) or later.
Q. Are there specific capabilities that NAM provides in a VSS environment that are distinct from the capabilities provided in a non-VSS environment?
A. Yes, there are three key differentiators:
• Monitoring port statistics on both switches using one NAM. The NAM can provide mini-RMON statistics on both switches and identifies these statistics by chassis, slot, and port. In this way, a complete view of Layer 2 traffic utilization can be obtained to assist in quickly identifying potential bottlenecks.
• Using SPAN on one NAM to obtain visibility into traffic on both virtual switches. Typically, RSPAN or NetFlow would need to be used to obtain visibility into an adjacent switch.
• Monitoring the health of both switches using a single NAM.
Q. What device does the Cisco Catalyst 6500 NAM monitor in the virtualized data center?
A. The Cisco Catalyst 6500 NAM can extend its visibility into the Cisco Nexus 1000V switch in deployment scenarios where the Cisco Catalyst 6500 is an End-of-Row (EoR) access switching platform in the virtualized data center. The Cisco Nexus 1000V switch is a software switch on a server that delivers Cisco Virtual Network Link (VN-Link) services to VMs hosted on the server. This distributed switch has two major components: the Virtual Ethernet Module (VEM) and the Virtual Supervisor Module (VSM), which manages the VEMs. The Cisco Nexus 1000V can be configured to direct NetFlow Data Export from virtual or physical interfaces on the Nexus VEM to the Cisco Catalyst 6500 NAM. Also, ERSPAN can be configured to enable the Cisco Catalyst 6500 NAM to remotely monitor the traffic in the VM network.
Q. What NAM data sources can be used to monitor traffic in the Cisco Nexus 1000V switch environment?
A. As previewed in the answer above, the Cisco Catalyst 6500 NAM can monitor the Cisco Nexus 1000V using ERSPAN and NetFlow data sources (for more information about these NAM data sources, please refer to Table 5 of this Q&A). ERSPAN can be configured on the Cisco Nexus 1000V to enable the Cisco NAM to obtain visibility into specific ports or VLANs. The data made available by ERSPAN permits the NAM to provide core traffic usage metrics (on applications, hosts, and conversations), response time analytics, and QoS and VLAN monitoring statistics. NetFlow Data Export can be configured on select virtual and physical interfaces of the Cisco Nexus 1000V. The data made available by NetFlow permits the NAM to provide core traffic analytics and QoS monitoring statistics.
Q. Where should I deploy the Cisco Catalyst 6500 NAM to obtain visibility into the virtualized data center?
A. The Cisco Catalyst 6500 NAM is ideally deployed in an EoR Catalyst 6500 switch. Using the ERSPAN data source from the Cisco Nexus 1000V, headers of designated traffic flows (by port or VLAN) are encapsulated in a GRE tunnel and forwarded to the Cisco NAM for analysis.
Q. When would I purchase a Cisco Catalyst 6500 NAM vs. a Cisco Nexus 1000V NAM VSB?
A. The Cisco Catalyst 6500 NAM is a hardware module integrated in the Cisco Catalyst 6500 that provides visibility into both physical and virtual networks. It comes with a feature set and level of performance commensurate with providing high-performance monitoring and troubleshooting in the campus or data center. The Cisco Nexus 1000V NAM VSB is a software module integrated in the Cisco Nexus 1010 Virtual Service Appliance. The Cisco Nexus 1000V NAM VSB comes with a feature set and level of performance that is specifically targeted for monitoring and troubleshooting the Cisco Nexus 1000V environment. The Cisco NAM VSB is a perfect fit for customers who are deploying the Cisco Nexus 1010, offering both ease of deployment and investment value. For those customers who have Cisco Catalyst 6500s, who may want to monitor more than the Cisco Nexus 1000V environment, who require higher overall performance, and/or who perform extensive captures and decodes will want to consider the Cisco Catalyst 6500 NAM. Additionally, the Catalyst 6500 NAM should be considered if a Cisco Catalyst 6500 is deployed in the data center access layer in VSS mode for high availability considerations. In this deployment scenario the Cisco Catalyst 6500 NAM can monitor switch ports and associated application traffic on both the Cisco Catalyst 6500 and on the Cisco Nexus 1000V.
Q. What protocols does the Cisco NAM monitor?
A. The Cisco NAM monitors several hundred unique protocols, including those defined in RFC 2896, and several Cisco proprietary protocols. In addition, the NAM can automatically detect unknown protocols and offers users the flexibility to customize the protocol directory to meet their specific requirements. Examples of protocols supported by the Cisco NAM for monitoring follow:
• TCP and User Datagram Protocol (UDP) over IP including IPv6
• HTTP and HTTPS
• VoIP including Skinny Client Control Protocol (SCCP), RTP/Real-Time Control Protocol (RTCP), Media Gateway Control Protocol (MGCP), and Session Initiation Protocol (SIP)
• SigTran and Mobile IP protocols including General Packet Radio Service (GPRS) Tunneling Protocol
• Storage area network (SAN) protocols including Fibre Channel over TCP/IP
• AppleTalk, DECnet, Novell, Microsoft
• Database protocols, including Oracle and Sybase
• Peer-to-peer protocols such as Gnutella, Fasttrack, and winmix
• Bridge and router protocols
• Cisco proprietary protocols
• Unknown protocols by TCP/UDP ports, Remote Procedure Call (RPC) program numbers, and so on
Q. What is the REST/XML API and how does it help me?
A. The NAM API provides a mechanism for provisioning and retrieving data from the NAM servers using an XML interface. The API utilizes Representational State Transfer (REST) methodology to execute requests (web services) over HTTP or HTTPS by sending the XML data to the API server. The REST XML interface is capable of configuring a subset of the software features through create, read, update, and delete operations mapped to a particular HTTP or HTTPS method. APIs are provided for sites, data sources, application, application groups, action, threshold, packet capture, WAAS-monitored server, system info, and NetFlow Data Export. The interface also allows you to create an outgoing stream of exported performance data from NAM as NetFlow records.
Q. Is SNMPv3 supported in NAM 5.0?
A. With NAM 5.0, you have the ability to manage devices with SNMPv3. Note that for the WS-SVC-NAM-1 and WS-SVC-NAM-2 platforms, SNMPv3 is not required. SNMP requests and responses are communicated over an internal interface within the chassis, and SNMPv3 is not used.
Q. How can I recognize and configure applications reported as unknown by NAM?
A. NAM recognizes application on the basis of port number, port number range or standardized application identifiers exported by Cisco platforms with NDE. If NAM is not able to recognize an application using any of these mechanisms, the application type of the traffic is reported as unknown. You can configure the application reported as unknown using the Application configuration table on the Traffic Analysis dashboard (
Analyze -> Traffic-Application). When selecting an "unknown" application, the table will list all protocol/port combinations that were not recognized by NAM and allow you to configure them as custom applications.
Q. Can I define my own application or application groups?
A. NAM identifies applications/protocols based on the TCP/UDP port number, thus if there are any applications using custom ports, the NAM can be configured to identify those applications by name instead of by port number(s). Custom applications can be defined combining a select protocol with port or port-range definitions. Custom application groups can be defined as a set of existing applications that can be monitored together. Please refer to the NAM Software 5.0 User Guide (Chapter 2) for instructions on how to create a custom application or application group.
Q. How can I understand various response time metrics, and how do they help me in troubleshooting application performance issues?
A. Please refer to NAM software 5.0 User Guide (Chapter 3).
Q. Why do I need custom filters for the interactive reports?
A. Interactive reports use advanced filters to allow you to focus on information of interest and create a context for further analysis. For example, when analyzing application performance, you can create a filter to focus on a select site, application, time range, client, server or a combination of the foregoing, offering a powerful mechanism to isolate performance issues. In addition, the custom filters allow you to save a specific context for on-going analysis. Typically, this is valuable when watching a recurring performance issue. In such cases, you would create a custom filter having the appropriate filter attributes. When you select the custom filter, the interactive report will load the data as per the context defined in the custom filter.
Q. Can more than one user concurrently use NAM?
A. Cisco NAM allows multiple users to access NAM concurrently. However, depending on what information the users are accessing, an increase in the number of concurrent users can result in a sub-optimal user experience in terms of interface response times.
Q. When would I define a site using data sources or VLANs?
A. NAM Software 5.0 introduces the concept of logical sites as collections of network endpoints. A site can be defined as a set of subnets specified by an address prefix and mask. In addition, sites can be defined using a remote device data source (such as a remote WAAS device, NDE from a remote network device) or VLANs. As examples, a site can be defined as a remote WAAS device representing the collection of endpoints for which an application is being optimized, or in the case of managed service delivery, a site could be defined as a VLAN representing a customer's premises. A combination of these mechanisms offers a granular way to define a site.
Q. How many simultaneous captures does the NAM support?
A. Cisco NAM can support up to 10 simultaneous packet capture sessions.
Q. Can packet captures be saved and, if so, where?
A. Yes. The Cisco NAM offers two options to save capture data. Captures that have been stored in the NAM's buffer can be saved to the NAM's local hard drive for real-time analysis or analysis at a later date. In addition, with Cisco NAM 3.5 or later, captures can be saved directly to a remote network file server (NFS) or Small Computer System Interface over IP (iSCSI) - supported device. Saving captures on a remote storage device allows the user to capture very large amounts of raw data, which can then be analyzed remotely by NAM.
Q. Can I trigger packet capture when the threshold is violated?
A. Yes, Cisco NAM allows you to define "Trigger Capture" as one of the alarm actions to start or stop a predefined capture session.
Q. How can I replicate my site definitions and application definitions across all my NAMs?
A. The REST/XML API introduced with NAM Software 5.0 allows you to create, update and delete site definitions. It also allows you to retrieve all site definitions from a given NAM. The functions allow you to replicate the site definitions programmatically across all the NAMs deployed in the network. A similar API exists for the definitions or application and application groups.
Q. Does the Cisco NAM perform historical traffic analysis?
A. Yes, NAM 5.0 takes you back to the past to understand what happened when an event affecting network performance occurred. It supports historical data analysis to accelerate problem resolution, advance optimization and capacity planning decisions.
Q. Does Cisco NAM support voice monitoring for Cisco VoIP deployments only?
A. No. Cisco NAM monitors Real-Time Monitoring Protocol and thus, by extension, can provide reporting on any VoIP protocol that runs on top of RTP, a Layer 4 protocol.
Q. Which VoIP signaling protocols does the Cisco NAM support?
A. Cisco NAM supports a breadth of standards-based VoIP signaling protocols, namely, SCCP, SIP, MGCP, and H.323.
Q. What are the key performance indicators for monitoring voice?
A. Cisco NAM offers real-time voice quality monitoring using standards-based MOS and key performance indicators such as jitter and packet loss. It calculates MOS based on ITU-T G.107 recommendations.
Q. Can I identify the phones affected by voice quality degradation?
A. Yes. Cisco NAM allows the administrator to pinpoint the individual RTP stream experiencing voice quality degradation. By correlating the RTP and signaling streams, Cisco NAM can report the phone numbers and alias for each endpoint.
Q. What Cisco Unified Communications Management Solutions support NAM?
A. The solutions are Cisco Unified Service Monitor and Cisco Unified Operations Manager.
Q. How do Cisco Unified Service Monitor and Cisco Unified Operations Manager support NAM?
A. Cisco Unified Service Monitor collects voice metrics from multiple NAMs to provide enterprisewide visibility into voice quality. Cisco Unified Service Monitor generates alerts on the voice quality degradation that is reported by Cisco Unified Operations Manager. Based on these alerts, Cisco Unified Operations Manager allows the user to navigate into NAM to glean near real-time views of both voice and network performance to perform rapid troubleshooting.
Q. How does Cisco NAM support Cisco Wide Area Application Services?
A. Cisco NAM uses the built-in instrumentation of the Cisco Wide-Area Application Engine devices as a data source to gather information on the optimized traffic to provide end-to-end application performance visibility in a Cisco WAAS environment. It measures application response time, transaction time, bandwidth usage, LAN/WAN data, and so on to provide end-to-end application performance metrics, accurately quantifying the impact of WAAS optimization and helping to validate ongoing optimization improvements. NAM is also able to identify the applications that would benefit the most from deploying Cisco WAAS. Analyzing response time data over a period of time, the administrator can identify the applications where optimization can result in a material increase in available bandwidth.
Q. Does Cisco NAM include an API to allow third-party reporting applications to use NAM as a source of data?
A. Yes, the Cisco NAM includes multiple mechanisms, such as NetFlow Version 9, SNMP, and comma-separated value (CSV)/HTTP to enable third-party reporting applications to collect data for networkwide reporting, trending, baselining, and capacity planning. The API allows you to use computed NAM data to feed in-house or third-party reporting applications that you already own, building up additional value and building out existing investments. NAM 5.0 introduces an XML/REST-based API for NAM configuration and NetFlow Version 9 as a flexible and standard mechanism for data export.
Q. How can a third party apply for approval to use the Cisco NAM API for integration?
A. A third party can enroll in the Cisco Developer Network Program at
http://www.cisco.com/go/cdn. During the enrollment process, the third party must select Network and Service Management as the solution technology and Cisco NAM as the network management product for integration. Once approved and the nondisclosure agreement (NDA) and NAM developer license agreement are signed, the third party will receive the API for integration.
Q. Are there currently third parties who have joined this program? How can a list of these vendors be obtained?
A. Yes. Today, reporting applications from third parties such as NetQoS, Compuware, Infovista, and others offer support for NAM. These reporting applications complement the NAM by using its rich metrics to build end-to-end views of application usage and performance and also to streamline the number of collection points in the network. A list of third parties supporting NAM can be found at
http://www.cisco.com/go/cdn, under Find a Partner, Network and Services Management, and Network Management Services Modules.
Q. What are the part numbers for the Cisco Catalyst 6500 Series and Cisco 7600 Series NAM?
A. Table 6 lists the part numbers for the NAMs.
Table 6. Cisco Catalyst 6500 Series and Cisco 7600 Series NAM Part Numbers
Cisco Part Number
Cisco Catalyst 6500 Series and Cisco 7600 Series Network Analysis Module-1 (Spare)
Cisco Catalyst 6500 Series and Cisco 7600 Series Network Analysis Module-2 (Spare)
Field-installable Memory Upgrade Kit for WS-SVC-NAM-1 and WS-SVC-NAM-2
Cisco Catalyst 6500 Series and Cisco 7600 Series Network Analysis Module Software 5.0
Q. How can the Cisco NAM Traffic Analyzer software be obtained?
A. The NAM software can be obtained in one of two ways. To obtain the latest NAM software with your new hardware order, order SC-SVC-NAM-5.0 when ordering the NAM hardware. The software will then be delivered preloaded on the hardware. If you already own the hardware, download the latest software from the Cisco.com Software Center using your SMARTnet access privileges.
Q. Must Cisco NAM software be downloaded from the Cisco.com Software Center when first deploying a Cisco Catalyst 6500 NAM?
A. No. Cisco NAM comes with the latest NAM software release. There is no need to download the software when first deploying the Cisco Catalyst 6500 NAM.
Q. How do I obtain access to a new Cisco NAM software release?
A. Customers who have purchased SMARTnet for their NAM are entitled to download new software releases from the Cisco.com Software Center.
Q. Do the NAM-1 and NAM-2 have their own software image? Where can I find it?
A. NAM-1 and NAM-2 share a common software image, which is loaded on the Cisco NAM during its manufacture. The images are also available in the Software Center on Cisco.com. When new releases are available, the NAM can be upgraded using FTP. For details regarding compatibility, download location, and so on, please see
Q. How is the Cisco NAM Traffic Analyzer application obtained? Is it included in the price of the NAM?
A. The Cisco NAM Traffic Analyzer application is embedded in the NAM and is included in the NAM's price.
Q. What is required to deploy the Cisco NAM solution?
A. The following are required to deploy the NAM solution including the NAM Traffic Analyzer:
• Cisco Catalyst 6500 Series or Cisco 7600 Series Supervisor Engine running Cisco Catalyst OS or Cisco IOS Software
• NAM running software version 4.2 or later (prior software versions are in the end-of-sale or end-of-life cycle)
• Web browser running English Firefox 3.6+ or Microsoft Internet Explorer 8+ or later (Microsoft Internet Explorer 7 is not supported)
Q. Does the Cisco NAM complement Cisco security solutions?
A. Yes. The Cisco NAM is also complementary to traditional Cisco security devices. Once an intrusion is seen, the NAM can analyze the details of what is going on. The NAM also helps to deploy inline security devices by constantly measuring VLAN throughput so that the inline device is sized correctly. And, as the network grows and traffic increases, the NAM can track resource usage for future capacity planning. Also, because the NAM can analyze traffic on either side of the inline device, it provides a useful way to gauge the effectiveness of these tools and to troubleshoot potential connectivity problems as they arise.
Q. What Cisco NAM training options are available?
A. The Cisco NAM training is available through instructor-led training. This training can be conducted as a standalone module or included with training modules on other Cisco Catalyst 6500 services blades.
Q. Where is additional information about the Cisco NAM found?