Editing ACI Fabric Settings

NAS

You can export flow records captured by Nexus Dashboard on a remote Network Attached Storage (NAS) with NFS.

Nexus Dashboard defines the directory structure on NAS where the flow records are exported.

You can export the flow records in Base or Full mode. In Base mode, only 5-tuple data for the flow record is exported. In Full mode the entire data for the flow record is exported.

Nexus Dashboard requires read and write permission to NAS in order to export the flow record. A system issue is raised if Nexus Dashboard fails to write to NAS.

Guidelines and limitations for network attached storage

Add network attached storage to export flow records

The workflow to add Network Attached Storage (NAS) to export flow records includes the following steps:

Add the onboarded NAS to Nexus Dashboard

Follow these steps to add the onboarded NAS to Nexus Dashboard.

1. Navigate to the Fabrics page:

   Manage > Fabrics

2. Choose the fabric with the telemetry feature enabled.

3. Choose Actions > Edit Fabric Settings.

4. Click Telemetry.

5. Click the NAS tab in the Telemetry window.

6. Make the necessary configurations in the General settings area.

   1. Enter the name in the Name field.

   2. In the NAS server field, choose the NAS server added to Nexus Dashboard from the drop-down list.

7. In the Collection settings area, choose the flow from the Flows drop-down list.

   • In Base mode, only 5-tuple data for the flow record is exported.

   • In Full mode, the entire data for the flow record is exported.

8. Click Save.

The traffic from the flows displayed in the Flows page is exported as a JSON file to the external NAS in the following directory hierarchy.

Navigate to Analyze > Flows to view the flows that will be exported.

Each flow record is written as a line delimited JSON.

JSON output file format for a flow record in base mode

{"fabricName":"myapic","terminalTs":1688537547433,"originTs":1688537530376,"srcIp":"2000:201:1:1::1","dstIp":"2000:201:1:1::3","srcPort":1231,"dstPort":1232,"ingressVrf":"vrf1","egressVrf":"vrf1","ingressTenant":"FSV1","egressTenant":"FSV1","protocol":"UDP"}

{"fabricName":"myapic","terminalTs":1688537547378,"originTs":1688537530377,"srcIp":"201.1.1.127","dstIp":"201.1.1.1","srcPort":0,"dstPort":0,"ingressVrf":"vrf1","egressVrf":"","ingressTenant":"FSV2","egressTenant":"","protocol":"ANY-HOST"}

JSON output file format for a flow record in full mode

{"fabricName":"myapic","terminalTs":1688538023562,"originTs":1688538010527,"srcIp":"201.1.1.121","dstIp":"201.1.1.127","srcPort":0,"dstPort":0,"ingressVrf":"vrf1","egressVrf":"vrf1","ingressTenant":"FSV2","egressTenant":"FSV2","protocol":"ANY-HOST","srcEpg":"ext-epg","dstEpg":"ext-epg1","latencyMax":0,"ingressVif":"eth1/15","ingressVni":0,"latency":0,"ingressNodes":"Leaf1-2","ingressVlan":0,"ingressByteCount":104681600,"ingressPktCount":817825,"ingressBurst":0,"ingressBurstMax":34768,"egressNodes":"Leaf1-2","egressVif":"po4", "egressVni":0,"egressVlan":0,"egressByteCount":104681600,"egressPktCount":817825,"egressBurst":0,"egressBurstMax":34768,"dropPktCount":0,"dropByteCount":0,"dropCode":"","dropScore":0,"moveScore":0,"latencyScore":0,"burstScore":0,"anomalyScore":0,"hashCollision":false,"dropNodes":"[]","nodeNames":"[\"Leaf1-2\"]","nodeIngressVifs":"[\"Leaf1-2,eth1/15\"]","nodeEgressVifs":"[\"Leaf1-2,po4\"]“ ,"srcMoveCount":0,"dstMoveCount":0,"moveCount":0,"prexmit":0,"rtoOutside":false,"events":"[[\\\"1688538010527,Leaf1-2,0,3,1,no,no,eth1/15,,po4,po4,,,,,0,64,0,,,,,,,,\\\"]]"}

Understanding flow telemetry

Flow telemetry allows users to see the path taken by different flows in detail. It also allows you to identify the EPG and VRF instance of the source and destination. You can see the switches in the flow with the help of flow table exports from the nodes. The flow path is generated by stitching together all the exports in order of the flow.

You can configure the Flow Telemetry rule for the following interface types:

In a Cisco ACI fabric, if you want to configure routed sub-interfaces from the UI, select L3 Out.

In an NX-OS fabric, physical or port channel flow rules are supported only on routed interfaces.

Flow telemetry monitors the flow for each fabric separately, as there is no stitching across the fabrics in a fabric group. Therefore, flow telemetry is for individual flows. For example, if there are two fabrics (fabric A and fabric B) within a fabric group, and traffic is flowing between the two fabrics, they will be displayed as two separate flows. One flow will originate from Fabric A and display where the flow exits. And the other flow from Fabric B will display where it enters and where it exits.

Configuring flows

Configure flow collection modes

Follow these steps to configure flow collection modes.

1. Navigate to Admin > System Settings > Flow Collection.

2. In the Flow Collection Modes area, select Flow Telemetry.

---

Enabling Flow Telemetry automatically activates Flow Telemetry Events. Whenever a compatible event takes place, an anomaly will be generated, and the What’s the impact? section in the Anomaly page will display the associated flows. You can manually configure a Flow Telemetry rule to acquire comprehensive end-to-end information about the troublesome flow.

---

Configure flow collection rules in a Cisco ACI fabric

Follow these steps to configure flow collection rules in a Cisco ACI fabric.

1. Navigate to the Telemetry window for your fabric.

   1. Navigate to the main Fabrics page:

      Manage > Fabrics

   2. In the table showing all of the Nexus Dashboard fabrics that you have already created, locate the LAN or IPFM fabric where you want to configure telemetry settings.

   3. Single-click on that fabric.

      The Overview page for that fabric appears.

   4. Click Actions > Edit Fabric Settings.

      The Edit fabric_name Settings window appears.

   5. Verify that the Telemetry option is enabled in the Enabled features area.

      The Telemetry tab doesn’t become available unless the Telemetry option is enabled in the Enabled features area.

   6. Click the Telemetry tab to access the telemetry settings for this fabric.

2. Click the Flow collection tab in the Telemetry window.

3. In the Mode area, click Flow telemetry.

4. In the Flow collections rules area, determine what sort of flow collection rule that you want to add.

   • VRF

   • Physical interface

   • Port channel

   • L3Out Sub-Interface

   • L3Out SVI

VRF

To add a VRF rule:

1. Click the VRF tab.

   A table with already-configured VRF flow collection rules is displayed.

   For any VRF flow collection rule in this table, click the ellipsis (…​), then click Edit rule to edit that rule or Delete rule to delete it.

2. Add a new rule by clicking Create flow collection rule.

   1. In the General area, complete the following:

      1. Enter the name of the rule in the Rule Name field.

      2. Choose the tenant from the Tenant drop-down list.

      3. Select the VRF from the VRF drop-down list.

      4. In the Subnets area, enter the subnet on which you intend to monitor the flow traffic. If you have endpoints that are under the same endpoint groups, then you can provide a rule to monitor the subnet.

      5. Click Add Subnet.

   2. Click Save.

Physical interface

To add a physical interface rule:

1. Click the Physical interface tab.

   A table with already-configured physical interface flow collection rules is displayed.

   For any physical interface flow collection rule in this table, click the ellipsis (…​), then click Edit rule to edit that rule or Delete rule to delete it.

2. Add a new rule by clicking Create flow collection rule.

   1. In the General area, complete the following:

      1. Enter the name of the rule in the Rule Name field.

      2. From the drop-down list, select an interface. You can add more than one row (node+interface combination) by clicking Add Interfaces. However, within the rule, a node can appear only once. Configuration is rejected if more than one node is added.

      3. In the Subnets area, enter the subnet on which you want to monitor the flow traffic.

      4. Click Add Subnet.

   2. Click Save.

Port channel

To add a port channel rule:

1. Click the Port channel tab.

   A table with already-configured port channel flow collection rules is displayed.

   For any port channel flow collection rule in this table, click the ellipsis (…​), then click Edit rule to edit that rule or Delete rule to delete it.

2. Add a new rule by clicking Create flow collection rule.

   1. In the General area, complete the following:

      1. Enter the name of the rule in the Rule Name field.

      2. From the drop-down list, select an interface. You can add more than one row (node+interface combination) by clicking Add Interfaces. However, within the rule, a node can appear only once. Configuration is rejected if more than one node is added.

      3. In the Subnets area, enter the subnet on which you want to monitor the flow traffic.

      4. Click Add Subnet.

   2. Click Save.

L3Out Sub-Interface

To add a L3Out sub-interface rule:

1. Click the L3Out Sub-Interface tab.

   A table with already-configured L3Out sub-interface flow collection rules is displayed.

   For any L3Out sub-interface flow collection rule in this table, click the ellipsis (…​), then click Edit rule to edit that rule or Delete rule to delete it.

2. Add a new rule by clicking Create flow collection rule.

   1. In the General area, complete the following:

      1. Enter the name of the rule in the Rule Name field.

      2. From the respective drop-down list, select a tenant, L3Out, encapsulation, and interface.

         

         ---

         • If the L3Out is not configured on the node, you cannot select any items from the drop-down list and you cannot configure the flow rule.

         • For and L3Out based interface rule, you can select Sub-Interface type L3Out from the L3Out drop-down menu. To configure other L3Out rules such as Port Channel, SVI, and Physical Interface, click the respective tab.

         ---

      3. In the Subnets area, enter the subnet on which you want to monitor the flow traffic.

      4. Click Add Subnet.

      5. Click Save.

L3Out SVI

To add an L3Out SVI rule:

1. Click the L3Out SVI tab.

   A table with already-configured L3Out SVI flow collection rules is displayed.

   For any L3Out SVI flow collection rule in this table, click the ellipsis (…​), then click Edit rule to edit that rule or Delete rule to delete it.

2. Add a new rule by clicking Create flow collection rule.

   1. In the General area, complete the following:

      1. Enter the name of the rule in the Rule Name field.

      2. Select the Enabled check box to enable the status. If you enable the status, the rule will take effect. Otherwise, the rule will be removed from the switches.

      3. From the respective drop-down list, select a tenant, L3Out, and encapsulation.

      4. In the Subnets area, enter the subnet on which you want to monitor the flow traffic.

      5. Click Add Subnet.

   2. Click Save.

3. Click Done.

Understanding Netflow

Netflow is an industry standard where Cisco routers monitor and collect network traffic on an interface. Netflow version 9 is supported.

Netflow enables the network administrator to determine information such as source, destination, class of service, and causes of congestion. Netflow is configured on the interface to monitor every packet on the interface and provide telemetry data. You cannot filter on Netflow.

Netflow in Nexus series switches is based on intercepting the packet processing pipeline to capture summary information of network traffic.

The components of a flow monitoring setup are as follows:

In an NX-OS fabric, port channel support is available if you monitor only the host-facing interfaces.

Understanding sFlow

sFlow is an industry standard technology traffic in data networks containing switches and routers. Nexus Dashboard supports sFlow version 5 on Cisco Nexus 3000 series switches.

sFlow provides the visibility to enable performance optimization, an accounting and billing for usage, and defense against security threats.

The following interfaces are supported for sFlow:

Microburst monitoring thresholds

This table provides the microburst monitoring thresholds.

Configure microburst monitoring

In a Cisco ACI fabric, follow these steps to configure microburst:

Guidelines and limitations in NX-OS fabrics

Add Kafka broker configuration

Follow these steps to configure the message bus and add kafka broker.

To attach a System Certificate to the message bus feature:

For more information on CA certificates, see Managing Certificates in your Nexus Dashboard.

Configure Kafka exports in fabric settings

Anomalies

Advisories

Statistics

There are no differences in the settings in the Statistics area when you choose Basic or Advanced in the Mode area.

Choose one or more of the following categories for statistics that you want to configure for the message bus stream:

Faults

There are no differences in the settings in the Faults area when you choose Basic or Advanced in the Mode area.

Choose one or more of the following severity levels for fault statistics that you want to configure for the message bus stream:

Audit Logs

There are no differences in the settings in the Audit Logs area when you choose Basic or Advanced in the Mode area.

Choose one or more of the following categories for audit logs that you want to configure for the message bus stream:

Guidelines and limitations for syslog

If the syslog server is not operational at a certain time, messages generated during that downtime will not be received by a server after the server becomes operational.

Add syslog server configuration

Follow these steps to add syslog server configuration.

Configure syslog to enable exporting anomalies data to a syslog server

Follow these steps to configure syslog to enable exporting anomalies data to a syslog server.