Cisco NGA 3240 scaling up to the competition

Mike Patterson speaks out
Learn more about Mike Patterson...
Archive

Aironet

Competitive Lab Tests

Tech Forums

How-to Tutorials

CCIE Gossip

Software based NetFlow Probes

Before investing in an expensive NetFlow Generator Appliance, many companies start off by implementing a feature rich yet less scalable software solution such as the nProbe or YAF which allows them to get an idea of how they want to deploy probes. YAF makes no claims about being scalable into the gigabit speeds, but the nProbe line is available as an appliance called nBox.

What should be noted about these soft probes — especially the nProbe is that they offer richer details in their exports than the more expensive hardware appliances. They include elements such as round trip time, packet loss, URLs, jitter, codec, etc. Cisco exports many of these details from IOS, but not on the NGA 3240 platform.

Cisco NGA 3240

However, Cisco's taking their NetFlow Generator Appliance to the next level. Earlier this year Cisco announced the end of life on the NGA 3140 and the arrival of the NGA 3240 which is capable of exporting over 1 million flows per second.

	Port Count	Flow Version	Max Throughput
Cisco NGA 3240	4	NetFlow v5, v9 & IPFIX	32 Gbps
Emulex EndaceFlow 3040	4	NetFlow v5, v9 & IPFIX	30 Gbps
nBox-10G	4	NetFlow v5, v9 & IPFIX	20-40 Gbps
nPulse CPX	2+	NetFlow v9	20 Gbps

As shown above, most of these appliances include four 10 Gbps monitoring interfaces which allow them to collect traffic from more than one network device simultaneously. With flow exports from a single NGA exceeding 1 million flows per second, they can exceed what most single NetFlow collector appliances on the market can handle. To deal with this problem, the Cisco NGA provides a one 1 Gbps management port for NetFlow Data Export and can round robin the flow volume to as many as six collectors. For this reason, flow collector vendors like Plixer have designed their distributed NetFlow collection architecture to allow consumers to reach across dozens of collectors to generate a single report representing 100% of the original traffic.

Round Robin Flow Exports

To ease the burden on flow collectors, NetFlow packets being exported from the Cisco NGA can be rotated among the specified collectors according to the desired weighting. This may avoid overloading any one collector with too many exported records/minute. If on the other hand you wish every flow to be exported to all collectors, a multi-destination policy can be applied:

A multi-destination policy can be applied

What about Flow Sampling?

To avoid the sampling issue which has crippled the growth of sFlow, some vendors have followed the nTop lead by allowing for a definable flow tuple. Cisco calls it Flexible Netflow. A definable tuple allows the consumer to specify which fields will be matched and collected in each flow record. For example, removing source and destination ports from the flow and adding layer 7 application can reduce the flow volume in some environments by as much as 90%.

Weigh NGA Features Carefully

To some NGA consumers capacity isn't the most important factor when making a purchase. Features like the ability to define the flow tuple and DPI capabilities that can provide layer 7 awareness are key differentiators depending on the needs of the business. With more web applications defaulting to a HTTPS connections, I believe SSL DPI could be a differentiator in the near future. So far, SonicWALL is the only vendor doing it and we expect more vendors to follow.

Mike Patterson's other blog stories:

Dell solves complex business problems

Enterasys Secure Networks

Mike Patterson speaks out

Systrax High-Impact Network Monitoring

TMCnet Advanced NetFlow Traffic Analysis