[j-nsp] IPV6 IPFIX Flow issues "nodata" on flow collector.

[Gustavo Santos]

Hi,

After some J-TAC and Plixer conversation, they figured out what was going
on..

Plixer was getting the flows without the flow direction information.

With that information, J-TAC asked to add the knob below ( flow direction)

set services flow-monitoring version-ipfix template <template-name>
flow-key   flow-direction

After that I got the IPv6 Traffic work on Plixer Scrutinizer.


Now J-TAC is checking why IPv4 Traffic is working without the flow-key
flow-direction knob.



2017-12-08 15:15 GMT-03:00 Michael Hare <michael.hare at wisc.edu>:

> I am having success with v4 and v6 ipfix on 16.1R6, coming from 14.1R8.
> Collector is nfcapd, tested platform is MX2010 MPC4E.
>
> -Michael
>
> >>-----Original Message-----
> >>From: juniper-nsp [mailto:juniper-nsp-bounces at puck.nether.net] On Behalf
> >>Of Gustavo Santos
> >>Sent: Monday, December 04, 2017 3:44 PM
> >>To: sthaug at nethelp.no
> >>Cc: juniper-nsp at puck.nether.net
> >>Subject: Re: [j-nsp] IPV6 IPFIX Flow issues "nodata" on flow collector.
> >>
> >>Hi Steinar,
> >>
> >>I am using about the same settings from IPv4 with IPv6 just changing the
> >>template version..
> >>
> >>About the flow monitoring settings I as using the same one as you can see
> >>below on IPv4 with IPv6, the current one was done after some tests...
> >>
> >>
> >>
> >>
> >>sampling {
> >>    traceoptions {
> >>        file ipfix.log size 10k;
> >>    }
> >>    instance {
> >>        FLOW-INSTANCE {
> >>            input {
> >>                rate 1000;
> >>                max-packets-per-second 10000;
> >>            }
> >>            family inet {
> >>                output {
> >>                    flow-server xxx.xxxx.xxx.xxx{
> >>                        port 9995;
> >>                        autonomous-system-type origin;
> >>                        no-local-dump;
> >>                        version-ipfix {
> >>                            template {
> >>                                ipv4;
> >>                            }
> >>                        }
> >>                    }
> >>                    inline-jflow {
> >>                        source-address xxx.xxx.xxx.xxx;
> >>                    }
> >>                }
> >>            }
> >>            family inet6 {
> >>                output {
> >>                    flow-server xxx.xxx.xxx.xxx {
> >>                        port 9995;
> >>                        autonomous-system-type origin;
> >>                        no-local-dump;
> >>                        version-ipfix {
> >>                            template {
> >>                                ipv6;
> >>                            }
> >>                        }
> >>                    }
> >>                    inline-jflow {
> >>                        source-address xxx.xxx.xxx.xxx;
> >>                    }
> >>                }
> >>            }
> >>        }
> >>
> >>
> >>
> >>
> >>vlan-id 2XX8;
> >>family inet6 {
> >>    sampling {
> >>        input;
> >>        output;
> >>    }
> >>    address 2001:xxx:0:xxx::216/64;
> >>}
> >>
> >>
> >>
> >>flow-monitoring {
> >>    version-ipfix {
> >>        template ipv4 {
> >>            flow-active-timeout 600;
> >>            flow-inactive-timeout 30;
> >>            template-refresh-rate {
> >>                packets 48000;
> >>                seconds 60;
> >>            }
> >>            option-refresh-rate {
> >>                packets 48000;
> >>                seconds 60;
> >>            }
> >>            ipv4-template;
> >>        }
> >>        template ipv6 {
> >>            flow-active-timeout 150;
> >>            flow-inactive-timeout 100;
> >>            template-refresh-rate {
> >>                seconds 10;
> >>            }
> >>            option-refresh-rate {
> >>                seconds 10;
> >>            }
> >>            ipv6-template;
> >>        }
> >>    }
> >>}
> >>
> >>2017-12-01 15:10 GMT-03:00 <sthaug at nethelp.no>:
> >>
> >>> > Anyone else had issues with Junos 16.1R4 with IPV6 and IPFIX?
> >>> >
> >>> > Here we use Plixer Scrutinizer as Flow collector and analyzer. IPv4
> flow
> >>> > monitoring is working as intended. With IPv6 , looks like the
> collector
> >>> is
> >>> > don´t know what to do with the data the Router is sending (MX480).
> >>> >
> >>> > After a Call , looks like the router is not sending the correct
> templates
> >>> > to Scrutinizer, the only information it can identify is the current
> >>> > interface traffic from the flows. But no source and destination ipv6
> >>> > address.
> >>>
> >>> Can't comment on 16.1R4. We're running IPFIX flow collection on 15.1R6
> >>> and it seems to be working reasonably well, both for IPv4 and IPv6. No
> >>> problem showing IPv6 addresses with nfdump.
> >>>
> >>> You may want to show your config.
> >>>
> >>> Steinar Haug, Nethelp consulting, sthaug at nethelp.no
> >>>
> >>_______________________________________________
> >>juniper-nsp mailing list juniper-nsp at puck.nether.net
> >>https://puck.nether.net/mailman/listinfo/juniper-nsp
>