Cisco Catalyst 6500 Series Network Analysis Module User Guide, 5.0(1T)
Overview
Downloads: This chapterpdf (PDF - 1.13MB) The complete bookPDF (PDF - 4.57MB) | Feedback

Overview

Table Of Contents

Overview

Introducing Cisco Prime Network Analysis Module 5.0(1T)

New Features in Cisco Prime Network Analysis Module 5.0(1T)

New Features in Cisco NAM 5.0

Dashboards

Logical Site

New Application Classification Architecture

Standards-Based NBI

NetFlow v9 Data Export

Historical Analysis

Logging In

Navigating the User Interface

Common Navigation and Control Elements

Menu Bar

Detailed Views

Context Menus

Quick Capture

Interactive Report

Chart View / Grid View

Mouse-Over for Details

Zoom/Pan Charts

Sort Grid

Bytes / Packets

Statistics

Context-Sensitive Online Help

Understanding How the NAM Works

Understanding How the NAM Uses SPAN

Understanding How the NAM Uses VACLs

Understanding How the NAM Uses NDE

Understanding How the NAM Uses WAAS

Configuration Overview

Configuring and Viewing Data


Overview


This chapter provides information about the Cisco Prime Network Analysis Module (NAM) 5.0(1T) software with the Cisco Catalyst 6500 Series Network Analysis Module (NAM-3), and describes the new features and how to navigate the interface.

This chapter contains the following sections:

Introducing Cisco Prime Network Analysis Module 5.0(1T)

Logging In

Navigating the User Interface

Understanding How the NAM Works

Understanding How the NAM Uses SPAN

Understanding How the NAM Uses VACLs

Understanding How the NAM Uses NDE

Understanding How the NAM Uses WAAS

Configuration Overview

Introducing Cisco Prime Network Analysis Module 5.0(1T)

The Cisco Prime Network Analysis Module (NAM) software enables network managers to understand, manage, and improve how applications and services are delivered to end users.

The Cisco Prime™ portfolio of enterprise and service provider management offerings supports integrated lifecycle management of Cisco architectures and technologies based on a business-centric framework. Built on an intuitive workflow-oriented user experience, Cisco Prime products dramatically increase IT productivity, network scalability, and control of the network infrastructure and endpoints.

The Cisco Prime Network Analysis Module (NAM) combines flow-based and packet-based analysis into one solution. The NAM can be used for traffic analysis of applications, hosts, and conversations, performance-based measurements on application, server, and network latency, quality of experience metrics for network-based services such as Voice over IP (VoIP) and video, and problem analysis using deep, insightful packet captures. The NAM includes an embedded, web-based GUI that provides quick access to the configuration menus and presents easy-to-read performance monitoring and analysis on web, voice, and video traffic.

New Features in Cisco Prime Network Analysis Module 5.0(1T)

Cisco Prime Network Analysis Module (NAM) 5.0(1T) is released only on the high performance Cisco Catalyst 6500 Series Network Analysis Module (WS-SVC-NAM-3). This release offers integrated, high performance application visibility and troubleshooting in high speed, high density Catalyst 6500 Campus Backbone and Data Center environments. This release is not supported on any other Cisco platforms.

This release increases visibility into both physical and virtual switch environments, and enhances Catalyst 6500 operational manageability in physical and VSS switching environments.

Other features in Cisco Prime NAM 5.0(1T) are:

Supports ERSPAN data for voice and RTP monitoring

Supports up to 60k RTP streams and 30k calls monitoring

Consolidates WebEx-relevant sessions into one call

New Features in Cisco NAM 5.0

The Cisco NAM 5.0 software introduced a completely redesigned interface and new capabilities. The following sections highlight the most significant changes.

Dashboards

The Cisco NAM 5.0 software introduced a redesigned interface and user experience, with more intuitive workflows and interactive reporting capabilities. The dashboard-style layouts show multiple charts in one window, thereby giving you the ability to view a lot of information at once.

There are two types of dashboards: One type is the "summary" views found under the Monitor menu, and the other type is the "over time" views found under the Analyze menu. The Monitor dashboards allow you to view network traffic, application performance, site performance, and alarms at a glance. From there, you can isolate one area, for example an application with response time issues, and then drill-down to the Analyze dashboard for further investigation.

Figure 1-1 shows an example of one of the Monitoring dashboards.

Figure 1-1 NAM Traffic Summary Dashboard

The Analyze dashboards allow you to zoom or pan to reselect the range. As you change the range, the related graphs at the bottom will update.

The dashboards can be extracted as a PNG. You can also create a Scheduled Export to have the dashboards extracted regularly and sent to you in CSV or HTML format (see Scheduled Exports, page 2-51).

Logical Site

The Cisco NAM 5.0 software introduced the capability for users to define a site, with which you can aggregate and organize performance statistics. A site is a collection of hosts (network endpoints) partitioned into views that help you monitor traffic and troubleshoot problems. A site can be defined as a set of subnets specified by an address prefix and mask, or using other criteria such as a remote device data source (for example, remote WAE device and segment information). If you want to limit the view of your network analysis data to a specific city, a specific building, or even a specific floor of a building, you can use the sites function.

You can also include multiple types of data sources in the site definition, and you can then get an aggregated view of all network traffic.

The predefined "Unassigned Site" makes it easy to bring up a NAM without having to configure user-defined sites. Hosts that do not belong to any user-defined site will automatically belong to the Unassigned Site.

Figure 1-2 shows an example of how a network may be configured using sites.

Figure 1-2 Site Level Aggregation

For information about defining and editing a site, see Sites, page 2-55.

New Application Classification Architecture

In NAM 4.x releases, the RMON-2 protocol directory infrastructure was used to identify applications and network protocols. Starting with NAM 5.0, the application classification scheme was changed to align with the methodology used by Cisco with technologies such as NBAR (Network-Based Application Recognition) and SCL. It also accepts standardized application identifiers exported by Cisco platforms with NDE (NetFlow Data Export).

This allows you to gain application visibility with consistent and unique application identifiers across the network. For example, you can view applications using a global unique identifier, as compared with multiple classification engines using different applications identifiers.

For information about set up, see Classification, page 2-64.

Standards-Based NBI

NBI (Northbound Interface), also referred to as API (Application Programming Interface) enables partners and customers to provision the NAM and extract performance data. Previous releases of NAM were limited to SNMPs, and direct-URL knowledge for access to some data, including the method by which CSV-formatted data is retrieved.

Starting with NAM 5.0, the NBI was expanded to include a Representational State Transfer (REST) web service for configuration, and retrieval of data pertaining to sites. Also introduced is the capability to export high-volume performance data in the form of Netflow v9 (see the next section, "NetFlow v9 Data Export").


Note REST does not support retrieval of performance data for sites.


REST is a set of guidelines for doing web services over HTTP. It takes advantage of the HTTP method (GET, POST, UPDATE, DELETE) as part of the request.

The REST request/response messages using the REST web service will contain XML data in the body content of the HTTP request. An XML schema will describe the message content format. All REST request/response messages are handled in XML format. Then the REST web service consumer can use any HTTP client to communitate with the REST server. To use the REST web service via HTTPS, the NAM crypto patch needs to be installed on the NAM.

The NBI web service will provide an external API interface for provisioning and retrieving performance data. For application developers who want to use the NAM APIs to provision network services and leverage data, see the Cisco Prime Network Analysis Module 5.0(1T) API Programmer's Guide. The developers who use the APIs should have an understanding of a high-level programming language such as Java or an equivalent.


Note Contact your Cisco account representative if you need to refer to the Cisco Prime Network Analysis Module 5.0(1T) API Programmer's Guide.


NetFlow v9 Data Export

The NAM uses NetFlow as a format for the ongoing streaming of aggregated data, based on the configured set of descriptors or queries of the data attributes in NAM. The NAM as a producer of NDE (NetFlow Data Export) packets was a new feature in NAM 5.0. The NAM's new functionality of NDE is part of the new NBI.

NetFlow collects traffic statistics by monitoring packets that flow through the device and storing the statistics in the NetFlow table. NDE converts the NetFlow table statistics into records, and exports the records to an external device, which is called a NetFlow collector.

The NDE descriptor is a permanent definition of the NAM aggregated data query of aggregated NAM data, which must be exported to designated destinations across the network using the industry-wide standard of NetFlow v9 instead of the standard UDP transport.

The NDE descriptor defines the data query that remains in effect as long as the NDE descriptor exists in NAM's permanent storage. Having it instantiated means that the NAM will be exporting the matching aggregated data records continuously (in a specified frequency) until the NDE descriptor is deleted or updated.

For information about set up, see Data Export, NetFlow, page 2-47.

Historical Analysis

The NAM stores short-term and long-term data that you can view using the dashboards. The NAM proactively collects and stores up to 72 hours of data at a granularity of 1, 5, or 10 minute intervals, and longer-term data with a granularity of 1 to 2 hours, This allows you to specify different time periods to view trends over time and identify potential problems.

Logging In

Log into the NAM by using the username and password that the NAM installer provided you, and click the Login button. If you are having problems logging in:

Make sure you are using a browser that is currently supported for use with NAM 5.0(1T):
English Firefox 3.6 (4.0 is not supported) or Microsoft Internet Explorer 8+ (Microsoft Internet Explorer 7 is not supported)

Make sure you are using a platform that is currently supported for use with NAM 5.0(1T):
Microsoft Windows XP, Microsoft Windows 7, or Macintosh running OSX Leopard.

Make sure you have JavaScript enabled.

Make sure you have downloaded the most recent version of Adobe Flash.

Clear the browser cache and restart the browser (not necessarily if installing NAM for the first time).

Make sure cookies are enabled in your browser.

If you see the following message: "Initializing database. Please wait until initialization process finishes," you must wait until the process finishes.

To view the full documentation set for the Cisco NAM (including this User Guide and Release Notes), go to the NAM Technical Documentation area on Cisco.com:

http://www.cisco.com/en/US/products/sw/cscowork/ps5401/
tsd_products_support_series_home.html

Navigating the User Interface

NAM 5.0 had introduced a redesigned interface and user experience, with more intuitive workflows and improved operational efficiency. This section describes the improved navigation and control elements in the user interface.


Note All times in the NAM are typically displayed in 24-hour clock format. For example, 3:00 p.m. is displayed as 15:00.


Common Navigation and Control Elements

Menu Bar

To perform the NAM functions, use the menu bar.

The selections enable you to perform the necessary tasks:

Home: Brings you to the Traffic Summary dashboard (Monitor > Overview > Traffic Summary).

Monitor: See "summary" views that allow you to view network traffic, application performance, site performance, and alarms at a glance.

Analyze: See various "over-time" views for traffic, WAN optimization, response time, managed device, and media functions.

Capture: Configure multiple sessions for capturing, filtering, and decoding packet data, manage the data in a file control system, and display the contents of the packets.

Setup: Perform all setup needed to run the NAM.

Administration: Perform user and system administration tasks, and generate diagnostic information for obtaining technical assistance.

Detailed Views

Under some topics in the mega-menu, the last selection is "Detailed Views." Click the small arrow to the right of the menu selections to see the sub-menu and the functions available.

Context Menus

On most charts that appear on the dashboards, you can left-click on a colored bar of data to get a context menu, with which you can get more detailed information about that item.

The example above is from the Traffic Summary dashboard, Top N Applications chart. The description to the right of "Selected Application" in the menu shows what item you had clicked on (in this case, "snmp").

The menu items above the separator line are specific to the selected element of the Top N chart. The items below the separator line are not specific to the selected element, but apply to the Top N chart.

Quick Capture

From the Context menu of many of the bar charts that show Applications or Hosts or VLANs. you can start a Capture.

For example, when you click on an Application in a barchart (as in the screenshot above) and choose Capture, the following is done automatically:

A memory-based capture session is created

A software filter is created using that application

The capture session is started

The decode window pops open and you can immediately see packets being captured.


Note Quick Capture does not use site definition/filter.


Interactive Report

In most Monitoring and Analyze windows, you can use the Interactive Report on the left side to view and change the parameters of the information displayed in the charts. You can redefine the parameters by clicking the Filter button on the left side of the Interactive Report.

The reporting time interval selection changes depending upon the dashboard you are viewing, and the NAM platform you are using. The NAM supports up to five saved Interactive Reports.

Chart View / Grid View

Most of the data presented by the NAM can be viewed as either a Chart or a Grid. The Chart view presents an overview of the data in an integrated manner, and can show you trending information. The Grid view can be used to see more precise data. For example, to get the exact value of data in graphical view, you would need to hover over a data point in the Chart to get the data, whereas the same data is easily visible in table format using Grid view. To toggle between the two views, use the Chart and Grid icons at the bottom of the panel:

Next to that icon is the "Show as Image" icon, with which you save the chart you are viewing as a PNG file.

Mouse-Over for Details

When in Chart view, you can mouse-over the chart to get more detailed information about what occurred at a specific time.

Many of the line charts in NAM are "dual-axis," meaning there is one metric shown on the left axis of the chart and another metric shown on the right axis of the chart.

For example, in the figure above, Total Bytes per second is shown on the left axis, and Total Packets per second is shown on the right axis.

Zoom/Pan Charts

For many charts, you can drag the beginning or end to change the time interval, as shown below.

The time interval change on the zoom/pan chart will affect the data presented in the charts in the bottom of the window. The zoom/pan time interval also affects the drill-down navigations; if the zoom/pan interval is modified, the context menu drill-downs from that dashboard will use the zoom/pan time interval.


Note In a bar chart which you can zoom/pan, each block represents data collected during the previous interval (the time stamp displayed at the bottom of each block is the end of the time range). Therefore, you may have to drag the zoom/pan one block further than expected to get the desired data to populate in the charts in the bottom of the window.


Sort Grid

When looking at information in Grid view, you can sort the information by clicking the heading of any column. Click it again to sort in reverse order.

Bytes / Packets

On most Analyze charts, you can use the "Bytes" and "Packets" check boxes at the top to specify which information you would like the chart to display.

Statistics

The Statistics legend gives you the minimum, maximum, and average statistics of the data. This will display the initial data retrieved for the selector.

Above the Statistics legend is a dropdown selector, which allows you to choose which of the metrics shown in the "over-time" chart you would like reflected in the Statistics legend. For example, if the line chart has Bytes or Packets in the check boxes above the line chart, the selector over the Statistics legend will show the same choices, Bytes or Packets.

Context-Sensitive Online Help

The "Help" link on the top-right corner of the NAM interface will bring you to the Help page for that particular window of the GUI.

In addition to the Help link on the top-right corner of each page, some pages also have a blue "i", which provides help for that specific subject.

Understanding How the NAM Works

The Network Analysis Module (NAM) product family addresses the following major functional areas:

Network Layer Traffic Analysis. The NAM provides comprehensive traffic analysis to identify what applications are running over the network, how much network resources are consumed, and who is using these applications. The NAM offers a rich set of reports with which to view traffic by Hosts, Application or Conversations. See the discussions about dashboards, starting with Traffic Summary, page 3-4.

Application Response Time. The NAM can provide passive measurement of TCP-based applications for any given server or client, supplying a wide variety of statistics like response time, network flight time, and transaction time.

WAN Optimization insight. The NAM can provide insight into WAN Optimization offerings that compress and optimize WAN Traffic for pre- and post-deployment scenarios. This is applicable for Optimized and Passthru traffic.

Voice Quality Analysis. The NAM provides application performance for real time applications like Voice and Video. The NAM can compute Mean Opinion Score (MOS), as well as provide RTP analysis for the media stream. See Media, page 3-35.

Advanced Troubleshooting. The NAM provides robust capture and decode capabilities for packet traces that can be triggered or terminated based on user-defined thresholds.

Open instrumentation. The NAM is a mediation and instrumentation product offering, and hence provides a robust API that can be used by partner products as well as customers that have home grown applications. See the Cisco NAM 5.0 API Programmer's Guide for more information (contact your account representative for this document).

The NAM delivers the above functionality by analyzing a wide variety of data sources that include:

Port mirroring technology like SPAN and RSPAN/ERSPAN. The NAM can analyze Ethernet VLAN traffic from the following sources: Ethernet, Fast Ethernet, Gigabit Ethernet, trunk port, or Fast EtherChannel SPAN, RSPAN, or ERSPAN source port

VACL

NetFlow Data Export (NDE). The NAM can analyze NetFlow Data Export (NDE) from Managed Devices (Routers/Switches)

WAAS

SNMP

Starting with NAM 5.0, the NAM has the ability to use SNMP as a southbound interface for configuration and data retrieval from switches and routers. NAM 5.0 moved away from RMON and toward web services and Netflow Data Export as the northbound interface for data objects. The NAM continues to support baseline manageability features of SNMP such as MIB-2 and IF-TABLE, and the health status and interface statistics that can be used by external products like Fault and Configuration Management offerings (for example, CiscoWorks LMS).

For more information about SPAN, RSPAN, and ERSPAN, see the "Configuring Local SPAN, RSPAN, and ERSPAN" chapter in the Catalyst 6500 Series Switch Software Configuration Guide.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/
configuration/guide/span.html

Table 1-1 summarizes the traffic sources that are used for NAM monitoring.

Table 1-1 Summary of Traffic Sources for NAM Monitoring 

Traffic Source
LAN
WAN
 
Ports
VLANs
Ports
VLANs

VACL capture

Yes

Yes

Yes

N/A

NetFlow Data Export NDE (local)

Yes

Yes

Yes

Yes

NetFlow Data Export NDE (remote)

Yes

Yes

Yes

Yes

SPAN

Yes

Yes

No

No

ERSPAN

Yes

Yes

No

No


The next sections describe how the NAM uses the supported data sources:

Understanding How the NAM Uses SPAN

Understanding How the NAM Uses VACLs

Understanding How the NAM Uses NDE

Understanding How the NAM Uses WAAS

Understanding How the NAM Uses SPAN

A switched port analyzer (SPAN) session is an association of a destination port with a set of source ports, configured with parameters that specify the monitored network traffic. You can configure up to two SPAN sessions in a Catalyst 6500 switch chassis. Newer Cisco IOS images may support more than two SPAN sessions. Consult the Cisco IOS document for the number of SPAN sessions supported per switch or router.

The WS-SVC-NAM-3 platform provides two possible destination ports for SPAN and VLAN access control list (VACL) sessions. Multiple SPAN sessions to the NAM are supported, but they must be destined for different ports. The NAM destination ports for use by the SPAN graphical user interface (GUI) are named DATA PORT 1 and DATA PORT 2 by default.

For more information about SPAN and how to configure it on the Catalyst 6500 series switches, see the Catalyst 6500 Series Switch Software Configuration Guide:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/
guide/span.html


Note Due to potentially very high volume of ERSPAN traffic from the source, we recommend that you do not terminate the ERSPAN session on the NAM management port. Instead, you should terminate ERSPAN on the switch, and use the switch's SPAN feature to SPAN the traffic to NAM data ports.


Understanding How the NAM Uses VACLs

A VLAN access control list can forward traffic from either a WAN interface or VLANs to a data port on the NAM. A VACL provides an alternative to using SPAN; a VACL can provide access control based on Layer 3 addresses for IP and IPX protocols. The unsupported protocols are access controlled through the MAC addresses. A MAC VACL cannot be used to access control IP or IPX addresses.

There are two types of VACLs: one that captures all bridged or routed VLAN packets and another that captures a selected subset of all bridged or routed VLAN packets. Catalyst operating system VACLs can only be used to capture VLAN packets because they are initially routed or bridged into the VLAN on the switch.

A VACL can provide access control for all packets that are bridged within a VLAN or that are routed into or out of a VLAN or, with Release 12.1(13)E or later releases, a WAN interface. Unlike regular Cisco IOS standard or extended ACLs that are configured on router interfaces only and are applied on routed packets only, the VACLs apply to all packets and can be applied to any VLAN or WAN interface. The VACLs are processed in the hardware.

A VACL uses Cisco IOS access control lists (ACLs). A VACL ignores any Cisco IOS ACL fields that are not supported in the hardware. Standard and extended Cisco IOS ACLs are used to classify packets. Classified packets can be subject to a number of features, such as access control (security), encryption, and policy-based routing. Standard and extended Cisco IOS ACLs are only configured on router interfaces and applied on routed packets.

After a VACL is configured on a VLAN, all packets (routed or bridged) entering the VLAN are checked against the VACL. Packets can either enter the VLAN through a switch port or through a router port after being routed. Unlike Cisco IOS ACLs, the VACLs are not defined by direction (input or output).

A VACL contains an ordered list of access control entries (ACEs). Each ACE contains a number of fields that are matched against the contents of a packet. Each field can have an associated bit mask to indicate which bits are relevant. Each ACE is associated with an action that describes what the system should do with the packet when a match occurs. The action is feature dependent. Catalyst 6500 series switches support three types of ACEs in the hardware: IP, IPX, and MAC-Layer traffic. The VACLs that are applied to WAN interfaces support only IP traffic.

When you configure a VACL and apply it to a VLAN, all packets entering the VLAN are checked against this VACL. If you apply a VACL to the VLAN and an ACL to a routed interface in the VLAN, a packet coming into the VLAN is first checked against the VACL and, if permitted, is then checked against the input ACL before it is handled by the routed interface. When the packet is routed to another VLAN, it is first checked against the output ACL applied to the routed interface and, if permitted, the VACL configured for the destination VLAN is applied. If a VACL is configured for a packet type and a packet of that type does not match the VACL, the default action is deny.

When configuring VACLs, note the following:

VACLs and context-based access control (CBAC) cannot be configured on the same interface.

TCP Intercepts and Reflexive ACLs take precedence over a VACL action on the same interface.

Internet Group Management Protocol (IGMP) packets are not checked against VACLs.


Note You cannot set up VACL using the NAM interface.


For details on how to configure a VACL with Cisco IOS software, see the Catalyst 6500 Release 12.2SXF and Rebuilds Software Configuration Guide.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/
guide/vacl.html

For details on how to configure a VACL on a WAN interface and on a LAN VLAN, see VACL, page 2-17.

Understanding How the NAM Uses NDE

The NAM uses NetFlow as a format for the ongoing streaming of aggregated data, based on the configured set of descriptors or queries of the data attributes in NAM. NetFlow Data Export (NDE) is a remote device that allows you to monitor port traffic on the NAM; the NAM can collect NDE from local or remote switch or router for traffic analysis.

To use an NDE data source for the NAM, you must configure the remote device to export the NDE packets. The default UDP port is 3000, but you can configure it from the NAM CLI as follows:

root@nam2x-61.cisco.com# netflow input port ?
<port>                    - input NDE port number 

The distinguishing feature of the NetFlow v9 format, which is the basis for an IETF standard, is that it is template-based. Templates provide an extensible design to the record format, a feature that must allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format.

For more detailed information about NAM and NetFlow, see NetFlow, page 2-18.

For specific information about creating and managing NDE queries, see the Cisco Prime Network Analysis Module 5.0(1T) API Programmer's Guide (contact your account representative for this document).

Understanding How the NAM Uses WAAS

Cisco Wide Area Application Services (WAAS) software optimizes the performance of TCP-based applications operating in a wide area network (WAN) environment and preserves and strengthens branch security. The WAAS solution consists of a set of devices called Wide Area Application Engines (WAEs) that work together to optimize WAN traffic over your network.

When client and server applications attempt to communicate with each other, the network devices intercepts and redirects this traffic to the WAEs to act on behalf of the client application and the destination server.

WAEs provide information about packet streams traversing through both LAN and WAN interfaces of WAAS WAEs. Traffic of interest can include specific servers and types of transaction being exported. NAM processes the data exported from the WAAS and performs application response time and other metrics calculations and enters the data into reports you set up.

The WAEs examine the traffic and using built-in application policies to determine whether to optimize the traffic or allow it to pass through your network not optimized.

You can use the WAAS Central Manager GUI to centrally configure and monitor the WAEs and application policies in your network. You can also use the WAAS Central Manager GUI to create new application policies so that the WAAS system will optimize custom applications and less common applications.

For more information about WAAS data sources and managing WAAS devices, see Understanding WAAS, page 2-28.

Configuration Overview

Table 1-2. "Configuration Overview" leads you through the basic steps for setup that you can follow for Cisco Prime Network Analysis Module (NAM) 5.0(1T).

These are not necessarily in the order in which you need to perform them, and many are optional features.

Table 1-2 Configuration Overview 

Action
Description
NAM GUI Location
User Guide Location
Install the NAM

--

--

Installation and Configuration Guides for NAM platforms (http://www.cisco.com/en/US/products/sw/cscowork/ps5401/prod_installation_guides_list.html)

Set up the System Time

You will need to set up the System Time correctly; if you do not have the time synchronized, then you will see either incorrect or no data.

Administration > System > System Time

System Time, page 5-5

Verify that traffic has started

Traffic usage statistics for applications, hosts, conversations, VLANs, and DSCP are available on the Traffic Summary dashboard.

This will start automatically after you turn on the NAM.

Home (Traffic Summary dashboard)

or

Monitor > Overview > Traffic Summary

See Traffic Analysis, page 2-1.

Verify that Application Response Time Metrics are being gathered

The NAM software provides response time measurements and various user-experience-related metrics, which are computed by monitoring and time-stamping packets sent from the user to the server providing services.

This will start automatically after you turn on the NAM.

Analyze > Response Time.

You can view response times for applications, networks, servers, and clients.

See Application Response Time Metrics, page 2-2

Verify that Voice/RTP Stream Traffic is being gathered

After the NAM is started, Voice/RTP stream traffic will automatically start being monitored. The NAM enables you to monitor all RTP stream traffic among all SPANed traffic, without having to know the signalling traffic used in negotiating the RTP channels.

This will start automatically after you turn on the NAM.

Analyze > Media > RTP Streams

or

Analyze > Media > Voice Call Statistics.

See Voice Signaling/RTP Stream Monitoring, page 2-2

Configure NDE Data Export

The NAM sends out NDE packets only in NDE v9 format.

Setup > Data Export > NetFlow

NetFlow, page 2-47

Configure sites

A site is a collection of hosts (network endpoints) partitioned into views that help you monitor traffic and troubleshoot problems.

If you want to limit the view of your network data to a specific city, a specific building, or even a specific floor of a building, you can use the Sites function.

We recommend that sites are configured using prefix-based subnets instead of based on data source.

Setup > Network > Sites.

See Sites, page 2-55.

Define Alarms and Thresholds

Alarms are predefined conditions based on a rising data threshold, a falling data threshold, or both. You can choose for what types of events you want the NAM to notify you, and how you want to be notified.

Alarms that will be used for Thresholds should be created first, then then the Thresholds created second.

Setup > Alarms > Actions

and

Setup > Alarms > Thresholds

Alarm Actions, page 2-35

Thresholds, page 2-37

Configure Capture

Capture allows you to configure up to ten sessions for capturing, filtering, and decoding packet data, manage the data in a file control system, and display the contents of the packets.

Capture > Packet Capture/Decode

Chapter 4, "Capturing and Decoding Packet Data."

Configure Scheduled Export

You can set up scheduled jobs that will generate a daily report at a specified time, in the specified interval, and then e-mail it to a specified e-mail address.

In the Interactive Report (left side of the dashboard), click the Export button.

Scheduled Exports, page 2-51

Set up Northbound API

NBI (Northbound Interface), also referred to as API (Application Programming Interface), enables partners and customers to provision the NAM and extract performance data.

You can write your own scripts based on the NAM Northbound API, but there is setup in the NAM GUI needed.

 

For application developers who want to use the NAM APIs to provision network services and leverage data, see the Cisco Prime Network Analysis Module 5.0(1T) API Programmer's Guide.

Set up TACACS+ server

TACACS+ is a Cisco Systems enhancement that provides additional support for authentication and authorization.

When a user logs into the NAM, TACACS+ determines if the username and password are valid and what the access privileges are.

Administration > Users > TACACS+

Configuring a TACACS+ Server to Support NAM Authentication and Authorization, page 5-16

Change System Preferences

You can change many preferences, such as refresh interval, Top N Entries, Data Displayed, and enabling Audit Trail, as needed.

Administration > System > Preferences

Chapter 5, "User and System Administration."


Configuring and Viewing Data

Some of the NAM features require configuration of sites. A site is a collection of hosts, or network endpoints, partitioned into views that help you monitor traffic and troubleshoot problems (see Sites, page 2-55 for more detailed information). These features include those in which the NAM provides measurements of application performance on networks where WAAS devices are deployed, and dashboards that show traffic levels between sites and alarms levels per site. All other NAM features can still be used without defining any sites (the default configuration).

If you have set up sites, you will be able to select a particular site to view in the Interactive Report and view data relevant to that site only. In some cases, you can select both a Client Site and a Server Site to view data pertaining to interaction between hosts at different sites.