Cisco - Cisco 2600/3660/3700 Series Nework Analysis Module Data Sheet

Cisco Systems^® is addressing the need for multiservice network management and traffic monitoring in enterprise branch offices with a new network analysis module (NAM) for Cisco^® 2600XM Series, Cisco 2691 multiservice platforms, the Cisco 3660 Multiservice Platform, and Cisco 3700 Series multiservice access routers. The Cisco 2600/3660/3700 Series NAM is an integrated traffic-monitoring network module that enables network managers to gain application-level visibility into network traffic with the ultimate goal of improving performance, reducing failures, and maximizing return on network investments.

The Cisco 2600/3660/3700 Series NAM expands the Cisco NAM solution currently available for Cisco Catalyst^® 6500 Series switches and Cisco 7600 Series routers. Cisco NAMs give network managers visibility into all layers of network traffic by providing application-level Remote Monitoring (RMON) functions based on RMON2 and other advanced MIBs. They provide intelligence to analyze traffic flows for applications, hosts, conversations, and network-based services such as quality of service (QoS) and voice over IP (VoIP). Cisco NAMs come with an embedded, Web-based traffic analyzer, which provides full-scale remote monitoring and troubleshooting capabilities that are accessible through a Web browser (Figure 2).

Integrated LAN and WAN Monitoring for the Full Service Branch

The Cisco 2600/3660/3700 Series NAM can be deployed in the Cisco 2600XM Series, the Cisco 2691 Multiservice Platform, the Cisco 3660, and the Cisco 3700 Series at WAN edges or at remote branch offices. It provides the unique advantage of performing remote troubleshooting and traffic analysis through its Web-based NAM Traffic Analyzer without having to send personnel or haul large amounts of data to the central site.

The Cisco 2600/3660/3700 Series NAM uses several data sources from local and remote switches and routers to provide combined visibility into LAN and WAN environments in a Full Service Branch office. Traffic from selected LAN or WAN ports can be copied by the router through a special packet-monitoring feature in Cisco IOS^® Software and sent to the integrated NAM for analysis through an internal backplane interface. Also, traffic from LAN ports in the router or from nearby switches can be sent through an external Fast Ethernet interface. In addition, the NAM collects and analyzes NetFlow Data Export from local and remote devices to provide broad application-level visibility into the network.

Figure 3 highlights the deployment of the Cisco 2600/3660/3700 Series NAM to enable comprehensive traffic monitoring and analysis in a branch office.

Major Benefits

Increased return on network investment—The visibility provided by the NAM enables better usage of WAN links to meet business objectives. The NAM eases deployment of network-based services and helps in capacity planning.
Increased productivity and revenue—Through proactive monitoring and quick troubleshooting capabilities, the NAM prevents productivity and revenue losses due to network degradation and downtime.
Enhanced network security—The NAM provides investigation and verification capabilities to supplement other security mechanisms such as intrusion detection and firewalls. They can also be used to detect threats by watching anomalies in the network traffic.

Features and Applications

The data collected by Cisco 2600/3660/3700 Series NAM can be used for several vital management activities, including WAN usage monitoring, application performance management, fault isolation, troubleshooting, and capacity planning. The NAM also plays an active role in managing differentiated services such as voice.

WAN Usage Monitoring at the Application Level

Using RMON2 and several extended RMON MIBs, as well as NetFlow, Cisco 2600/3660/3700 Series NAM detects the applications on the network and provide detailed real-time and historical information about how these applications utilize the bandwidth, which hosts access those applications, and which client and server pairs generate the most traffic (Figure 4).

Monitoring Application Performance

The Cisco 2600/3660/3700 Series NAM provides valuable information about the application performance as experienced by the clients in branch offices. Using the Application Response Time (ART) MIB, developed by Cisco partner NetScout Systems, the NAM can track response time at different points in the network to isolate application performance problems related to the network or to the application server (Figure 5).

Fault Isolation and Troubleshooting

Using the Cisco 2600/3660/3700 Series NAM, network managers can set thresholds and alarms on various network parameters such as increased utilization, severe application response delays, and voice quality degradation, and be alerted to potential problems. The NAM provides comprehensive views on applications, hosts, voice, QoS, and more, to isolate faults or malfunctions in the network. The NAM Traffic Analyzer can capture and decode packets in real time to aid troubleshooting (Figure 6).

VoIP and QoS Monitoring

Cisco 2600/3660/3700 Series NAM can analyze voice traffic flows in real time to collect valuable information, including call setup details and voice quality metrics. Network managers can be alerted to voice quality degradation and can isolate potential problems (Figure 7).

Cisco 2600/3660/3700 Series NAM makes the deployment of QoS for voice and other critical services effective by identifying violations of QoS policies. The NAM supports the Differentiated Services Monitoring (DSMON) MIB, which monitors traffic by differentiated services code point (DSCP) allocations defined by QoS policies (Figure 8).

Capacity Planning and Other Extended Applications

Cisco 2600/3660/3700 Series NAM serves as data sources for several other standards-based applications for a variety of purposes including capacity planning, long-term historical reporting and trending, anomaly-based threat detection, etc.

Primary Advantages

Integration with network infrastructure—The Cisco 2600/3660/3700 Series NAM occupies a single network module slot within the Cisco 2600XM, 3660, and 3700 series and the Cisco 2691, and is deployed and supported as an integral part of the network infrastructure. It is managed as a part of the network device using CiscoWorks management tools.
Easy deployment and operation—Because Cisco NAMs integrate monitoring functions directly into the router and have complete data collection and data analysis capabilities onboard, they are easy to deploy and network managers can conveniently access data from anywhere using a Web browser.
Total cost of ownership savings—The integrated nature of the Cisco NAM solution saves costs in operations, maintenance, and technical support. The NAM Traffic Analyzer is embedded in the NAMs at no extra cost. The maintenance for the Cisco 2600/3660/3700 Series NAM is covered with the router.
Extensible, standards-based solution—The Cisco 2600/3660/3700 Series NAM is compliant with open standards, and can be used with different monitoring applications to meet diverse needs.
Secure solution—The NAM Traffic Analyzer can be deployed with up to 168-bit encryption, and Simple Network Management Protocol (SNMP) can be disabled for fortifying external access to the NAM. The NAM supports Secure Shell (SSH) Protocol for secured command-line access.

Network Monitoring Solutions

Cisco offers a wide variety of solutions to provide complete visibility into network infrastructure. The comprehensive Cisco solution includes embedded technologies such as mini-RMON, NetFlow, Service Assurance Agent (SAA), and Network-Based Application Recognition (NBAR); NAMs for the Cisco Catalyst 6500 Series and Cisco 7600 Series and Cisco 2600, 3660 and 3700 Series for value-added traffic analysis; and CiscoWorks network monitoring applications. Cisco AVVID (Architecture for Voice, Video and Integrated Data) partners extend the Cisco network monitoring solution through a variety of applications that use embedded data sources and NAMs.

Technical Specifications

The Cisco 2600/3660/3700 Series NAM Hardware

Optimized performance single processor architecture with 256 MB of RAM and a 20-GB hard disk drive
Two Fast Ethernet monitoring interfaces: one "internal" backplane interface for receiving copy of LAN or WAN traffic sent through a special packet-monitoring feature in the router's Cisco IOS Software, and one "external" interface for receiving traffic directly from local or remote LAN ports; either can be used for management traffic and for receiving NetFlow data
Fast Ethernet-class monitoring performance (while using internal monitoring interface, it is recommended to monitor up to 10-Mbps traffic on the Cisco 2600XM Series and the Cisco 2691, and up to 45-Mbps traffic on Cisco 3660 and 3700 series routers; external monitoring interface can be used for higher-capacity monitoring)

Supporting Router Platforms and Cisco IOS Software

The Cisco 2600/3660/3700 Series NAM can be deployed in any network module slot in the Cisco 2600XM Series, Cisco 2691, Cisco 3660, and Cisco 3700 Series
Only one NAM is supported per router chassis
Cisco 2600/3660/3700 Series NAM is supported with Cisco IOS Software Release 12.3(4)XD or later (all software images)

Supported Topologies and Data Sources for Monitoring

WAN—Packets on WAN interfaces are copied in the Cisco Express Forwarding path by a special packet-monitoring feature in Cisco IOS Software and sent to the Cisco 2600/3660/3700 Series NAM through the internal backplane interface for analysis at the IP layer and up; NetFlow (versions 1, 5, 6, 7, and 8) from local and remote devices are sent through the internal or external interface
LAN— An external Ethernet interface receives packets directly from local or remote LAN ports; packets on LAN interfaces are copied in the Cisco Express Forwarding path by a special packet-monitoring feature in Cisco IOS Software and sent to Cisco 2600/3660/3700 Series NAM through the internal backplane interface for analysis at the IP layer and up; NetFlow (versions 1, 5, 6, 7, and 8) from local and remote devices are sent through the internal or external interface

Supported Interfaces and External Applications

HTTP and HTTPS with the embedded Web-based NAM Traffic Analyzer
SNMP versions1 and 2c with other standards-based applications:

Concord Communications has tested support with eHealth-Traffic Accountant version 5.6.5
Infovista has tested support with VistaView for Traffic Monitoring; VistaView for Application Monitoring version 5.0

NAM Traffic Analyzer

Embedded in Cisco Network Analysis Module Software 3.2 for Cisco 2600/3660/3700 Series NAM
Web-based—Requires Microsoft Internet Explorer 5.0 or Netscape 4.7 (minimum)
Support for Secure Sockets Layer (SSL) security with up to 168-bit encryption
Role-based user authorization and authentication locally or using TACACS+
Real-time and historical statistics (up to 100 days) on LAN and WAN traffic and network-based services

Cisco NAM Software 3.2

Supports Cisco 2600/3660/3700 Series NAM
Supported with Cisco IOS Software Release 12.3(4)XD or later (all images)

Supported MIB Groups

Cisco 2600/3660/3700 Series NAM is standards-compliant and supports RMON and RMON2 MIBs, as well as several extensions. The major MIB groups supported in the NAM are:

MIB-II (RFC 1213)
RMON (RFC 2819)
RMON2 (RFC 2021)
DSMON (RFC 3287)
HC-RMON (RFC 3273)
Application Response Time

Supported Protocols

Cisco 2600/3660/3700 Series NAM provides RMON2 statistics on several hundred unique protocols, including those defined in RFC 2896, and several Cisco proprietary protocols. In addition, the NAM can automatically detect unknown protocols and users have the flexibility to customize the protocol directory.

Examples of protocols supported by Cisco 2600/3660/3700 Series NAM for RMON2 statistics include:

TCP and UDP over IP including IPv6
VoIP including Skinny Client Control Protocol (SCCP), Real Time Protocol/ Real Time Control Protocol (RTP/RTCP), Media Gateway Control Protocol (MGCP), and Session Initiation Protocol (SIP)
Mobile IP protocols
Storage area network (SAN) protocols including Fibre Channel over TCP/IP
AppleTalk, DECnet, Novell, Microsoft
Database protocols including Oracle or Sybase
Bridge and router protocols
Cisco proprietary protocols
Unknown protocols by TCP/UDP ports, Remote-Procedure Call (RPC) program numbers, etc.

Physical Specifications

Dimensions (H x W x D): 1.55 x 7.10 x 7.2 inches (3.9 x 18.0 x 18.3 centimeters)
Weight: 1.5 pounds (0.7 kilograms) maximum

Operating Environment

Operating temperature: 32° F (0° C) to 104° F (40° C)
Nonoperating and storage temperature: -40° F (-40° C) to 158° F (70° C)
Operating humidity: 5 % to 95 % (noncondensing)
Operating altitude: 0 to 10,000 feet (3000 meters)

Agency Approvals

Safety: UL 1950; CSA-C22.2 No. 950, EN 60950, IEC 60950
EMC: FCC Part 15 Class A; EN55022 Class B; AS/NZS 3548 Class A; CISPR22 Class B; VCCI Class B; EN55024; EN61000-3-2; EN61000-3-3

Ordering Information

Table 1 provides the ordering information for the Cisco 2600/3660/3700 Series NAM.

Table 1 Cisco 2600/3660/3700 Series NAM Ordering Information

Cisco Part Number	Description
NM-NAM	Cisco 2600/3660/3700 Series Network Analysis Module
NM-NAM=	Cisco 2600/3660/3700 Series Network Analysis Module (Spare)
NM-NAM-SW-3.2	Cisco Network Analysis Module Software 3.2 for NM-NAM

More Information

Data Sheet

Cisco 2600/3660/3700 Series Network Analysis Module

The Cisco 2600/3660/3700 Series Network Analysis Module (Figure 1) provides application-level visibility into network traffic for troubleshooting, performance monitoring, capacity planning, and managing network-based services.