flow exporter

ADVANCED NETFLOW Business and IT are Changing Like Never Before Drastic Change in Application Type, Delivery, and Consumption
Public/Hybrid
Cloud
SaaS/IaaS
Users/
Machines
Proliferation
of Devices
THE
NETWORK
Storage Private
Cloud
VDI | IaaS
60% of IT professional cites performance as key challenge for cloud How AaType pplica<ons pplica<on of applica<ons aare re CDonsumed elivered Database Cisco Network Devices Embedded Instrumenta<on Applica<on Visibility and Control What is Needed App Visibility & User Experience Report NFv9/IPFIX App BW Transac&on Time … SAP 3M 150 ms … Sharepoint 10M 500 ms … High Med Low Repor<ng Tools Applica<on Recogni<on Iden<fy applica<ons using L3 to L7 informa<on Repor&ng Perf. TCool ollec<on & Expor<ng Collect applica<on performance metrics, and export to management tool Management Tool Advanced repor<ng tool aggregates and reports applica<on performance Control Control applica<on network usage to improve applica<on performance Applica<on Visibility and Control Enabled Technologies App Visibility & User Experience Report NFv9/IPFIX App BW Transac&on Time … SAP 3M 150 ms … Sharepoint 10M 500 ms … High Med Low Repor<ng Tools Applica<on Recogni<on Repor&ng Perf. TCool ollec<on & Expor<ng Management Tool Control •  Uniﬁed Monitoring •  NBAR2 •  Metadata -  Traﬃc Sta<s<cs -  Response Time -  Voice/Video Monitoring -  URL Collec<on Cisco Prime Infrastructure •  QoS (w/ NBAR2) •  PfR What do we want to monitor? Traﬃc Sta<s<cs URL Visibility •  Applica<on Usage per client IP/
subnet/site •  Top clients per applica<on •  Most visited web-‐
site •  Per-‐URL applica<on response <me Applica<on Response Time •  Per-‐applica<on end-‐to-‐end latency •  Applica<on response <me & transac<on <me •  Applica<on processing <me •  Top conversa<on per applica<on Media Performance •  Per-‐stream jider and packet loss •  RTP conversa<ons Evolu<on of Applica<ons •  Sta<c port classiﬁca<on is no longer enough •  Increasing use of Encryp<on and Obfusca<on •  Applica<on consists of mul<ple sessions (Video, Voice, Data) Deﬁne Your Own Applica<on in NBAR2 Port Payload HTTP URL •  TCP or UDP •  16 sta<c ports per applica<on •  Range of ports (1000 maximum) • Search the ﬁrst 255 bytes of TCP/UDP payload • ASCII (16 characters) • Hex (4 bytes) • Decimal (1-‐4294967295) • Variable (4 bytes Hex) •  URI regex •  Host regex New 9 NBAR2 – Regular Updates In-‐service Applica<on Deﬁni<on Update PPX (Major) • protocols~ 10 •  updates and ﬁxes 1M PPX.1 (Minor) 1M PPY (Major) • Bug ﬁxes • small updates PPY.1 (Minor) 1M • Bug ﬁxes • small updates •  Protocols~10 •  updates and ﬁxes PP 4.1 Available •  Protocol Pack Protocoln Protocol2 Protocol1 –  Includes all supported Protocols / Applica<ons –  Support Traﬃc categoriza<on and Adributes –  Available (as Default protocol pack) in DATA image Protocol Pack –  Periodic releases and Oﬀers SLA NBAR2 NBAR2 Protocol Pack Example • 
• 
• 
Add new applica<ons recognized by NBAR2 without IOS upgrade or router reload New protocol pack is published every two months on CCO Single IOS CLI to enable the protocol pack Applica<on Response Time §  27 Applica<on Response Time (ART) Metrics §  Interact with NBAR2 for Applica<on ID Datacenter Delay Key Features HQ How do I ensure my SLA is met Network Delay Beneﬁts §  Visibility into applica<on usage and performance §  Quan<fy user experience §  Track service levels for applica<on delivery Branch Delay §  Troubleshoot applica<on performance WAN1 (IP-‐VPN) PA ISR Repor<ng Tool ASR ASR §  Standard NFv9 and IPFIX export WAN2 (IPVPN, DMVPN) PA PA ISR ISR My email is slow! My query is taking long &me! PA ISR Media Monitoring -‐ Voice and Video Performance FNFv9 Alarm Syslog
Management Tool FNFv9 Alarm Syslog
Voice/video Endpoints WAN
Voice/video Endpoints Media Monitoring Key Features
Benefits
Monitor media performance metrics, i.e. jitter, loss
Real-time monitoring of voice and video performance
across network
Integrate with NBAR2 to identify applications
Setting threshold and generating alert/alarm
Accelerate troubleshooting – identify what, where, when
is the problem
Standard FNFv9 export
Proactive troubleshooting
Validate SLA
Flexible NetFlow (FNF) Expor<ng Process: NetFlow v9 and IPFIX Flexible & Extensible Flow Export Format Neplow Version 5 Neplow v9 / IPFIX Flow record Describe ﬂow format A Flow record •  Fixed number of ﬁelds (18 ﬁelds) e.g. source/des<na<on IP & port, input/
output interfaces, packet/byte count, ToS Flow record A Flow record A Collector Flow record Describe ﬂow format B Exporter Flow record Collector Exporter Sta<c Flow Export Format Flow record B •  Users deﬁne ﬂow record format •  Flow format is communicated to collector Version 5 Flow Format Flow Key vs. Non-‐Key Field Time of Day §  Start sysUpTime §  End sysUpTime §  Source IP address §  Des<na<on IP address §  Source TCP/UDP port §  Des<na<on TCP/UDP port Port U&liza&on §  Input ifIndex §  Output ifIndex §  Type of service §  TCP ﬂags §  Protocol §  Next hop address §  Source AS number §  Dest. AS number §  Source preﬁx mask §  Dest. Preﬁx mask Usage QoS §  Packet count §  Byte count From/to Applica&on Rou&ng and Peering NetFlow Cache Example 1.  Create and update ﬂows in NetFlow cache Srclf
SrclPadd
Dstlf
DstlPadd
Protocol
TOS
Flgs
Pkts
Src
Port
Src
Msk
Src
AS
Dst
Port
DstM
sk
Dst
AS
NextHop
Bytes/
Pkt
Active
Idle
Fa1/0
173.100.21.2
Fa0/0
10.0.227.12
11
80
10
11000
00A2
/24
5
00A2
/24
15
10.0.23.2
1528
1745
4
Fa1/0
173.100.3.2
Fa0/0
10.0.227.12
6
40
0
2491
15
/26
196
15
/24
15
10.0.23.2
740
41.5
1
Fa1/0
173.100.20.2
Fa0/0
10.0.227.12
11
80
10
10000
00A1
/24
180
00A1
/24
15
10.0.23.2
1428
1145.5
3
Fa1/0
173.100.6.2
Fa0/0
10.0.227.12
6
40
0
2210
19
/30
180
19
/24
15
10.0.23.2
1040
24.5
14
§  Inac&ve &mer expired (15 sec is default) §  Ac&ve &mer expired (30 min is default) => change it 1 min §  NetFlow cache is full (oldest ﬂows are expired) §  RST or FIN TCP ﬂag 2.  Expira&on Srclf SrclPadd Dstlf DstlPadd Protocol TOS Flgs Pkts Src Port Src Msk Src AS Dst Port Dst
Msk Dst AS NextHop Bytes/
Pkt Ac&ve Idle Fa1/0 173.100.21.2 Fa0/0 10.0.227.12 11 80 10 11000 00A2 /24 5 00A2 /24 15 10.0.23.2 1528 1800 4 3.  Aggrega&on 4.  Export version 5.  Transport protocol (UDP, SCTP) Export Packet Header Non-‐aggregated ﬂows—export version 5 or 9 Payload (Flows) E.g., Protocol-‐Port Aggrega&on Scheme Becomes Protocol Pkts SrcPort DstPort Bytes/Pkt 11 11000 00A2 00A2 1528 Aggregated Flows—Export Version 8 or 9 NetFlow Export Version 5 and Main Cache Conﬁgura<on Example Router(config)# interface <slot/port/subinterface>
Router(config-if)# ip flow ingress
Router(config-if)# ip flow egress
Router(config)# ip flow-cache entries <number>
Router(config)# ip flow-cache timeout active <minutes>
Router(config)# ip flow-cache timeout inactive <seconds>
Router(config)# ip flow-export version 5 peer-as
Router(config)# ip flow-export destination 10.10.10.10 1234
Router(config)# ip flow-export source loopback 0
NetFlow Flow Keys on the Router •  By default, the 7 ﬂow keys are: –  Source IP address, des<na<on IP address, source port, des<na<on port, Layer 3 protocol type, TOS byte (DSCP), input interface •  The 12 NetFlow aggrega<ons allow to reduce/change the number of ﬂow keys –  Example: source preﬁx aggrega<on = source network, source interface –  Can be seen as a diﬀerent view of the main cache •  Egress NetFlow, MPLS-‐aware NetFlow, etc. –  Specify new ﬂow keys •  Note: on the Cisco Catalyst®, we speak of the ﬂow mask –  This eﬀec<vely specify the ﬂow keys 18 Flow Keys on the Cisco Catalyst 6500/7600 The Flow Mask (before SUP2T) Full-Interface
VLAN
SRC IP
DST IP
IP Protocol
Src Port
Dst Port
IP Protocol
Src Port
Dst Port
Src Port
Dst Port
Src Port
Dst Port
Src Port
Dst Port
Src Port
Dst Port
Full
VLAN
SRC IP
DST IP
Destination-Source-Interface
VLAN
SRC IP
DST IP
IP Protocol
Source-Only
VLAN
SRC IP
DST IP
IP Protocol
Destination-Only
VLAN
SRC IP
DST IP
IP Protocol
Destination-Source
VLAN
Flow Keys in Orange SRC IP
DST IP
IP Protocol
Extensibility and Flexibility Requirements Phases Approach •  Tradi<onal NetFlow with v5 or v8 NetFlow export –  New requirements: build something ﬂexible and extensible •  Phase One: NetFlow Version 9 –  Advantages: extensibility •  Integrate new technologies/data types quicker (MPLS, IPv6, BGP next hop, etc.) •  Integrate new aggrega<ons quicker Expor&ng Process –  Note: for now, the template deﬁni<ons are ﬁxed •  Phase Two: Flexible NetFlow –  Advantages: cache and export content ﬂexibility •  User selec<on of ﬂow keys •  User deﬁni<on of the records Metering Process 20 Expor<ng Process versus Metering Process and NetFlow Evolu<on •  Expor<ng Process versus Metering Process are IPFIX (IP Flow Informa<on eXport) terms: the NetFlow term doesn’t make the dis<nc<on The Metering Process generates Flow Records. Inputs to the process are packet headers, characteris<cs, and Packet Treatment observed at one or more Observa<on Points. –  Tradi<onal NetFlow –  Flexible NetFlow –  Metric Media<on Agent (Media<on func<on expor<ng performance metrics) –  and some others The Expor<ng Process sends IPFIX Messages to one or more Collec<ng Processes = the export protocol –  NetFlow export version 5, version 7, version 8, version 9 –  IPFIX (RFC 7011), which is version 10 (as it’s based on NetFlow version 9) Expor<ng Process versus Metering Process and NetFlow Evolu<on Export Metric Media<on Agent Infrastructure FNF NBAR2 Perf Mon PA (ART) QoS PfR Use cases evolu<on and hence informa<on elements evolu<on + Diﬀerent sources of informa<on (diﬀerent metering processes) => we need some aggrega<on and correla<on in the router => we need a super metering process: the Metric Media<on Agent WAAS ﬁrewall 22 NetFlow Partners Traﬃc Analysis Denial of Service Billing CS-‐Mars hgp://www.cisco.com/en/US/prod/iosswrel/ps6537/ps6555/ps6601/networking_solu&ons_products_genericcontent0900aecd805ﬀ728.html NetFlow Open Source Tools Product Name
Primary Use
Comment
OS
Cflowd
Traffic Analysis
No longer supported
UNIX
Flow-tools
Collector Device
Scalable
UNIX
Flowd
Collector Device
Support V9
BSD, Linux
FlowScan
Reporting for Flow-Tools
IPFlow
Traffic Analysis
NetFlow Guide
Reporting Tools
NetFlow Monitor
Traffic Analysis
Supports V9
UNIX
Netmet
Collector Device
V5, support v9
Linux
NTOP
Security Monitoring
UNIX
Stager
Reporting for Flow-Tools
UNIX
Nfdump/nfsen
Traffic Analysis
UNIX
Support V9, IPv4, IPv6, MPLS,
SCTP, etc..
Linux,
FreeBSD,
Solaris
BSD, Linux
Support V5 and v9
Diﬀerent costs: implementa<on and customiza<on UNIX
NetFlow Version 9 • 
Version 9 is an export protocol –  No changes to the metering process • 
Version 9 is based on templates and separate ﬂow records –  Templates expressing type and length –  Flow records expressing template ID and list of values –  Sent the template regularly (conﬁgurable), because of UDP • 
• 
Support: 800, 1700, ISR (1800, 2800, 3800), ISR-‐G2 (1900, 2900, 3900), 2600, 3200, 3600, 3750, 4400, cat 3850, cat4500 , cat6500, cat 5760 (wireless controller), Cloud Services Router CSR-‐1000v, 7200, 7300, 7500, 7600, 10000, 12000 (IOS and IOS-‐XR), CRS-‐1, ASR 1000, ASR 9000, ASA 5580, Nexus 7000 and Nexus 1000V RFC3954 Cisco Systems® NetFlow Services Export Version 9 –  NetFlow patent: intellectual property right statement at the IETF website NetFlow Version 9 Export Packet H E A D E R Template FlowSet Template Record Template ID #1 Template Record Template ID #2 (Speciﬁc Field Types and Lengths) (Speciﬁc Field Types and Lengths) Template 1 Template 2 Data FlowSet FlowSet ID #1 Data FlowSet FlowSet ID #1 FlowSet ID #2 Data Record (Field Values) Data Record (Field Values) Data Record (Field Values) NetFlow Version 9 Export Packet Op<ons Template FlowSet Speciﬁes the Scope: Cache, System, Template, etc. Template 3 H E A D E R Op&ons Template FlowSet Op&on Template Record Template ID #3 (Speciﬁc Scope, Field Types and Lengths) Data FlowSet FlowSet ID #3 Op&on Data Record (Field Values) Op&on Data Record (Field Values) Interface Name Export with NetFlow Version 9 •  Example of op<ons template FlowSet: NetFlow exports the ifIndex •  Instead of the collector polling the ifName MIB variable for a speciﬁc ifIndex, the matching (ifIndex, ifName) is sent in an op<on data record Router(config)# ip flow-export interface-names
28 NetFlow Version 9 Main Cache Conﬁgura<on router(config)# ip flow-export version [5|9] [origin-as|peer-as]
[bgp-nexthop]
router(config)# ip flow-export template options export-stats
router(config)# ip flow-export template options timeout-rate 5
router(config)# ip flow-export template options refresh-rate 20
router(config)# ip flow-export template timeout-rate 5
• 
router(config)# ip flow-export template refresh-rate 20
router(config)# ip flow-export destination 10.10.10.10 9996
(Op&ons) Templates Sent SEent very (Op&ons) Templates Minutes or 20 Every FFive ive M
inutes 20 Packets
Should you export from the main cache with or Every Packets
NetFlow Version 5 or Version 9? 29 NetFlow Version 9 Aggrega<on Cache Conﬁgura<on router(config)# ip flow-aggregation cache bgp-nexthop-tos
router(config-flow-cache)# export destination 11.11.11.11 9999
router(config-flow-cache)# export version ?
9 Version 9
export format
router(config-flow-cache)# export version 9
router(config-flow-cache)# enabled In this case, we have only version 9. Why? Flexible NetFlow High-‐Level Concepts and Advantages •  Flexible NetFlow feature allows user conﬁgurable NetFlow record formats, selec<ng from a collec<on of ﬁelds: –  Key, non-‐key, counter, <mestamp •  Advantages: –  Tailor a cache for speciﬁc applica<ons, not covered by exis<ng 21 NetFlow features in tradi<onal NetFlow –  Diﬀerent NetFlow caches: per subinterface, per direc<on (ingress, egress), per sampler, per … –  Beder scalability since ﬂow record customiza<on for par<cular applica<on reduces number of ﬂows to monitor 31 Flexible NetFlow Mul<ple Monitors with Unique Key Fields Traﬃc Flow Monitor 1 Key Fields
Packet 1
Source IP
3.3.3.3
Destination IP
2.2.2.2
Source Port
23
Destination Port
22078
Layer 3 Protocol
TCP - 6
TOS Byte
0
Input Interface
Ethernet 0
Flow Monitor 2 Non-Key Fields
Key Fields Packet 1 Non-‐Key Fields Packets
Source IP 3.3.3.3 Packets Bytes
Dest IP 2.2.2.2 Timestamps Timestamps
Input Interface Ethernet 0 Next Hop Address
SYN Flag 0 Security Analysis Cache Traﬃc Analysis Cache Source
IP
Dest.
IP
Source
Port
Dest.
Port
Protocol
TOS
Input
I/F
…
Pkts
3.3.3.3
2.2.2.2
23
22078
6
0
E0
…
1100
Source IP Dest. IP Input I/F Flag … Pkts 3.3.3.3 2.2.2.2 E0 0 … 11000 Flexible NetFlow Model Interface
Monitor “A”
Monitor “B”
Exporter “M”
Monitor “C”
Record “X”
Record “Z”
Exporter “M”
Exporter “N”
Record “Y”
•  A single record per monitor •  Poten<ally mul<ple monitors per interface •  Poten<ally mul<ple exporters per monitor Service Planning FNF Conﬁgura<on -‐ Example 1. Conﬁgure the Exporter Router(config)# flow exporter my-exporter
Where do I want my data sent? Router(config-flow-exporter)# destination 1.1.1.1
2. Conﬁgure the Flow Record Router(config)# flow record my-record
Router(config-flow-record)#
destination address
What data do Imatch
want tipv4
o meter? Router(config-flow-record)# match ipv4 source address
Router(config-flow-record)# collect counter bytes
3. Conﬁgure the Flow Monitor Router(config)# flow monitor my-monitor
How do I want to cache informa&on? Router(config-flow-monitor)#
exporter
my-exporter
Router(config-flow-monitor)# record my-record
4. Apply to an Interface Router(config)# interface s3/0
Which interface do I want to monitor? Router(config-if)# ip flow monitor my-monitor input
Flexible NetFlow User-‐Deﬁned Record Conﬁgura<on Router(config)# flow record my-record
Router(config-flow-record)# match
Router(config-flow-record)# collect
Router(config-flow-record)# match ?
application
Application Fields
datalink
Datalink (layer 2) fields
flow
Flow identifying fields
interface
Interface fields
ipv4
IPv4 fields
ipv6
IPv6 fields
routing
routing attributes
transport
Transport layer field
Router(config-flow-record)# collect ?
application
Application Fields
counter
Counter fields
datalink
Datalink (layer 2) fields
flow
Flow identifying fields
interface
Interface fields
ipv4
IPv4 fields
ipv6
IPv6 fields
routing
IPv4 routing attributes
timestamp
Timestamp fields
transport
Transport layer fields
Specify a Key Field Specify a Non-‐Key Field Flexible Flow Record: Key Fields NEW Flow
IPv4
Sampler ID
IP (Source or
Destination)
Payload Size
IP (Source or
Destination)
Payload Size
Class ID
Prefix (Source or
Destination)
Packet Section
(Header)
Prefix (Source or
Destination)
Packet Section
(Header)
Interface
Mask (Source or
Destination)
Packet Section
(Payload)
Input
Mask (Source or
Destination)
Packet Section
(Payload)
Minimum-Mask
(Source or
Destination)
TTL
Minimum-Mask
(Source or
Destination)
DSCP
Protocol
Options bitmap
Protocol
Dest VLAN Fragmentation
Flags
Extension
Headers
Version
Traffic Class
Hop-Limit
Dot1q VLAN Fragmentation
Offset
Precedence
Flow Label
Length
Identification
DSCP
Option Header
Next-header
Header Length
TOS
Header Length
Version
Direction
Output
Layer 2 Source VLAN NEW Dot1q priority Source MAC address Des<na<on MAC address Total Length
IPv6
Payload Length
Flexible Flow Record: Key Fields NEW: 2 or 4 bytes Rou<ng Transport
src or dest AS Peer AS Traﬃc Index Destination Port
TCP Flag: ACK
Source Port
TCP Flag: CWR
ICMP Code
TCP Flag: ECE
Forwarding Status ICMP Type
TCP Flag: FIN
IGMP Type*
TCP Flag: PSH
TCP ACK Number
TCP Flag: RST
TCP Header Length
TCP Flag: SYN
TCP Sequence Number
TCP Flag: URG
TCP Window-Size
UDP Message Length
TCP Source Port
UDP Source Port
TCP Destination Port
UDP Destination Port
TCP Urgent Pointer
RTP SSRC
IGP Next Hop BGP Next Hop Input VRF Name
NEW *: IPv4 Flow only NEW Application
NEW Application ID
Multicast
Replication
Factor*
RPF Check
Drop*
Is-Multicast
Flexible Flow Record: Non-‐Key Fields Counters
Timestamp
IPv4
IPv4 and IPv6
Bytes
sysUpTime First
Packet
Total Length
Minimum (*)
Total Length Minimum (**)
sysUpTime First
Packet
Total Length
Maximum (*)
Total Length Maximum (**)
Bytes Long
Bytes Square Sum
Bytes Square Sum Long
Absolute first packet
TTL Minimum
TTL Maximum
Packets
Absolute last packet
Packets Long
Bytes replicated
• 
Bytes replicated Long
NEW Plus any of the poten<al “key” ﬁelds: will be the value from the ﬁrst packet in the ﬂow (*) IPV4_TOTAL_LEN_MIN, IPV4_TOTAL_LEN_MAX (**)IP_LENGTH_TOTAL_MIN, IP_LENGTH_TOTAL_MAX Packets replicated
Packets Replicated Long
NEW Flow Exporter Conﬁgura<on New in 15.3.1(T) and IOS XE 3.8 flow exporter <exporter-name>
destination <ipv4-address> [vrf <vrf-name>]
dscp <value>
export-protocol [netflow-v5 | netflow-v9 | ipfix ]
option {exporter-stats | interface-table | sampler-table |
vrf-table | application-table | application-attributes |
c3pl-class-table | c3pl-policy-table }
timeout <value in sec>
source <interface-name>
Eight Types of Op&ons template data timeout <value in sec>
Data Record transport udp <destination-port>
ttl <value>
output-features
New in 12.4(20)T NetFlow Exported Packets Go Through QoS, Crypto-‐Map, etc… Cisco Prime Infrastructure Cisco Prime Infrastructure Realizing the vision of One Management
Lifecycle Simpliﬁed deployment and conﬁgura<on Compliance Regulatory requirements and best prac<ces Assurance Improved Applica<on Delivery Cisco Prime Infrastructure Management of Wired and Wireless Devices Conﬁgura&on of features, Conﬁg Archive and Image Management Monitoring and Performance Trending Neslow collec&on and visibility of traﬃc ﬂowing through the infrastructure Consolidated Repor&ng and dashboards Trending and Analysis Consistent Visibility across the Enterprise Data Center
Cisco NAM Appliance
Cisco Nexus®
1000V
VM
VM
VM
Netflow and
AVC
And SNMP
Cisco ASR
VM
Cisco ISR
SNMP and Medianet
NAM on Nexus 1110
Netflow and AVC
And SNMP
SNMP and Medianet
Cisco WAAS
Cisco WAAS
San Jose Branch
Cisco Prime
WAN
NAM on ISR
-
Netwflow and
AVC and SNMP
Cisco- ISR
SNMP and Medianet
Cisco ISR
SNMP Poll
Amsterdam Branch
Branch to Branch
Traffic
SNMP and Medianet
Cisco WAAS
London Branch
Assurance Use Case Network Performance Site is experiencing bandwidth congestion. Troubleshoot and identify the users/applications responsible for bandwidth congestion SNMP Polling of Interface U<liza<on Top WAN interfaces Bandwidth u<liza<on over <me Applica<on U<liza<on over <me Applica<on u<liza<on over <me Top N reports for the interface Top Users by bandwidth Top Applica<ons by bandwidth Top talkers for applica<ons Find the users who are using the most bandwidth for the site QoS Se{ng for the Interface Class Map Sta<s<cs DSCP marking of Traﬃc Op<mizing the bandwidth (Control) QoS -‐> Enable QOS on the interface for bandwidth is op<mized for the cri<cal applica<ons End User Experience Jack Fields is having performance issues with accessing his critical applications. Search and ﬁnd user Search and ﬁnd user by name or IP Address Iden<fy Users Devices Jack Fields has 2 Wireless and 1 Wired Client User 360 View of Jack Fields 54 Iden<fy User and their applica<ons Devices and network performance Applica&ons and bandwidth Known what the user is doing Jack Fields conversa<ons to/from Users Jack Fields Voice Conversa<ons User compared to his site Users Site devices Worst Voice calls Applica<on Response 57 Iden<fy authen<ca<on issues (Wireless) Select troubleshoo<ng Select device Now we get a full the report on with hat tche ould have roblem gone wconnec<vity rong in the Aputh. process This results in a real-‐<me Now wtest, e get Auth. History of this device connec<vity in tthe his full case with respec<ve Auth. fails user to the respec<ve ISE sever, click on the failure reason Integra<on with ISE becomes very useful in this stage, select the ISE budon Iden<fy access issues (wireless) Click on the loca<on Thanks to colora<on of Clients with interferers we can locate connec<vity issues Everyone can do heatmaps User End to End Performance Connec&vity Cisco Switches
Cisco ISR/ASR
Users, their end points and applica<ons Cisco NAM
[Neslow, NBAR, NBAR2, AVC, Medianet] t End poin
to User g
mappin
Authen&ca&on and Access Authenticated
Wireless Users
Authenticated
Wired Users
Cisco Prime
Cisco ISE
Users devices

Download Report