Table Of Contents
Cisco CNS NetFlow
Collection Engine Version 4.0
Cisco CNS is a suite of intelligence engines that work with device agents to create a programmable network.
Cisco CNS extends the management plane of Cisco devices to a shared "programmable network" comprising three parts: a Cisco CNS Intelligent peer in network provisioning and monitoring; Cisco CNS intelligence engines, which are fault, configuration, accounting, performance, and security (FCAPS) engines and a subscriber policy server tightly coupled with the device agents; and the Cisco CNS Integration Bus, which provides a single, open, programmatic interface to the entire network (Figure 1).
Cisco Networking Services
Meeting Business Challenges
Cisco CNS NetFlow Collection Engine Version 4.0 (NFC 4.0) is a major release from the previous Cisco NetFlow Collector, Version 3.6.
The enterprise and service provider customers are facing the challenge of controlling costs for capital and operational expenses. At the same time, Cisco customers have to overcome WAN bandwidth congestion, delivering timely information to partners and vendors with high-quality performance and efficient deployment strategy. To overcome these difficulties, the Cisco NetFlow Collection Engine is an integral part of the programmable network layer; under the accounting category of the FCAPS model, it provides a technology metering of a key set of applications such as:
•Network traffic accounting
•Usage-based network billing
•Network capacity analysis and planning
•Network quality of service (QoS)
•Service-level agreement (SLA) performance monitoring
•Market usage statistics
•Irregular usage and denial-of-service detection capabilities for both service provider and enterprise customers
The key objectives of the Cisco CNS NFC 4.0 follow:
•Support for features that are becoming available in NetFlow services in Cisco IOS® Software, in particular the new V9 format, which allows devices to support data formats that are targeted to the capabilities of the devices, and which are described in "templates"
•Enhancement of the filtering and aggregation capabilities within the Cisco CNS NFC 4.0, which will include user definition of filtering and aggregation schemes where today the choice is fixed in the product
•Enhancement of the properties of Cisco NFC as a component within the network management infrastructure
The Cisco CNS NFC 4.0 collects, filters, and aggregates NetFlow data export from Cisco network elements. The Cisco CNS NFC 4.0 release is backward compatible with the previous Cisco NFC 3.6 release, and it has the following major features of the Cisco CNS NFC 4.0:
NetFlow V9 format support
The V9 data format is a major enhancement that is being implemented in the Cisco IOS NetFlow service. The new format allows the data that will be exported from a device to be specified by a "template," which specifies which of the available NetFlow statistics will actually be exported in a flow. The available templates are fixed on a device for a specific Cisco IOS release. Within a flow, template information is periodically sent out in order that the collector can understand how to unpack the data. The template information contained in the flow describes the data fields and field lengths. The template definitions will also be published as part of the documentation set for each Cisco IOS release in order that end users can design aggregation schemes and threads ahead of deployment.
The Version 9 format is an enhancement to NetFlow to support different technologies such as multicast, IP Security (IPSec), and Multiprotocol Label Switching (MPLS). Cisco CNS NFC 4.0 transparently supports MPLS-enabled NetFlow in V9 format.
The Cisco CNS NFC 4.0 is compatible with the previous NetFlow data format (NFC 3.6). Cisco CNS NFC 4.0 recognizes flows that contain V1, V5, V7, and V8 data formats, and makes their data available to the Cisco CNS NFC 4.0 filters and aggregation schemes.
Cisco Network Services NetFlow Data Analyzer Version 3.6 (NDA 3.6) is designed to operate with Cisco Network Services NetFlow Collection Version 3.5 (NDA 3.5).
The key values of the aggregation scheme in Cisco CNS NFC 4.0:
1. Data reduction
•Previously used DetailCallRecord
–Keys: srcaddr, dstaddr, srcport, dstport, protocol, type of service (ToS), input interface, output interface
–Now use InterfaceMatrix
–Keys: srcaddr, dstaddr, input interface, ToS
•Removal of four keys dramatically decreases the number of unique records.
•It is impossible to verify without detailed sample traffic, but there is potential for greater than 75-percent reduction in Cisco NFC output. This would significantly impact scale and performance.
2. Users can define aggregation schemes by choosing keys values.
3. Users can create, modify, delete, and list aggregation schemes.
4. Users can export and import aggregation scheme data in order to support copying of aggregation schemes between Cisco CNS NFC 4.0 systems.
5. Aggregation schemes corresponding to those supported in Cisco CNS NFC 3.0 will be supplied as part of Cisco CNS NFC 4.0 and will have the same names as in Cisco CNS NFC 3.0.
6. The thread definition in Cisco NFC 4.0 will be the same as in Cisco CNS NFC 3.0.
XML or CNS configuration and control API
Cisco NFC 4.0 integrates with CNS using the Cisco CNS Integration Bus. This interface allows CNS applications to configure and manage the Cisco NetFlow Collection Engine and uses XML to format application-specific messages.
As part of the CNS programmable network product family, Cisco NFC 4.0:
•Presents a uniform programmable interface to northbound applications
•Can be used in concert with other CNS programmable network products
Linux platform—RedHat v7.2.
Cisco CNS NFC 4.0 can be deployed on a Linux platform using RedHat Linux V7.2.
CNS Programmable Network product family Cisco IE Intelligence Engine hardware
The enterprise and service provider customers are facing the challenge of controlling costs for capital and operational expenses. At the same time, Cisco customers have to overcome WAN bandwidth congestion, delivering timely information to partners and vendors with high-quality performance and efficient deployment strategy. The hardware appliance helps overcome these challenges by providing improved product performance and a higher volume of storage. Also, the key value of the Cisco IE 2110 hardware is to provide to customers a field-replaceable unit (FRU) that scales into their points of presence (POPs) so that they can minimize all the operational overhead of distributed UNIX administration. Cisco CNS NFC 4.0 is supported for deployment on the Cisco IE 2110 appliance.
Cisco CNS NFC 4.0 operates with the following platforms:
XML and CNS Configuration
Cisco CNS NFC 4.0 integrates with CNS using the CNS Integration Bus. This interface allows CNS applications to configure and manage the CNS NetFlow Collection Engine and uses XML to format application-specific messages. Refer to the Installation and User Guide URL: http://www.cisco.com/public/ordsum.html.
Summary of Compatibility with Previous CNS NetFlow Collection Releases
Cisco NDA 3.6 is designed to operate with Cisco CNS NFC 3.5, but Cisco NDA 3.5 has been tested to operate with Cisco CNS NFC 4.0 (based on Cisco NDA 3.5 functionality).
For the short term, Cisco is working aggressively with its partners Concord, Infovista, Digiquant, and many other companies to provide and integrate all the NDA features of the Cisco NDA 3.6 with the Cisco NFC 4.0 and beyond. The plan and schedule will be published soon.
Version of NDA
Cisco CNS NFC 4.0
Cisco NFC 3.5
Cisco NFC 3.0
Cisco NDA 3.6
Compatible with Cisco NFC 3.5 functionality only
Cisco documentation is available in the following ways:
Registered Cisco direct customers can order Cisco product documentation from the Networking Products MarketPlace:
Registered Cisco.com users can order the Documentation CD-ROM through the online SubscriptionStore:
Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco corporate headquarters (California, United States) at 408 526-7208 or elsewhere in North America at 800 553-NETS (6387).