Flow Collection (RN50) Deployment Guide

Requirements for integrating Flow Data into the RISC Networks Platform


Integrating Flow Data into the RISC Networks Platform refers to the use of either Packet Capture or Netflow data streams in order to provide additional information to the standard connectivity reporting. Specifically, this provides data rate information such as Total Bytes, Max Kbps, and Average Kbps that cannot be derived from socket based dependency data alone.


In order to incorporate Flow Data in the RISC Networks Platform an addition appliance (RN50) is required and must be deployed as needed to provide “visibility” into the interesting traffic. The specific deployment scenarios will vary based on the environment and specific requirements. The most common deployment scenarios are discussed below. The key take away is that you must ensure you are providing visibility into all possible network data paths associated with application, and subsequently the specific workloads you are interested in. Capturing most or some of the traffic associated with the applications being measured can lead to inaccurate assumptions.


Virtual Machines

For VMware based virtual environments you must deploy the RN50 onto each VMware host (ESXi Hypervisor) that supports the Virtual Machines in-scope for analysis. This is because traffic between two Virtual Machines residing on the same host stays local to the host and does not “hit the wire”. The specific deployment process will depend on the virtual networking deployment in use (i.e. Standard vSwitch or Distributed vSwitch). In this deployment scenario, the RN50 is deployed in packet capture mode (i.e. mirror) using either promiscuous mode (Standard vSwitch) or Port Mirroring (Distributed vSwitch).


Physical Servers

For physical servers (i.e. Windows, Linux, Unix) you must use SPAN or Port Mirroring at the physical switch layer to mirror all interesting traffic to the RN50. In this deployment scenario, the RN50 is deployed in packet capture mode and must be connected to the destination port of the switch SPAN session. It is likely that multiple RN50 appliances will be required depending on the number of physical workloads in scope and their physical connectivity to the switching infrastructure. Keep in mind that the RN50 is a Virtual Appliance and must be deployed on a supported hypervisor with adequate physical resources.


Netflow

If the supporting network infrastructure supports Netflow you can configure the network devices to export Netflow data to the RN50. In this deployment scenario, the RN50 can be deployed in a more centralized fashion and accept data from multiple Netflow sources. Some network devices can only provide Netflow sampling as traffic passes Layer 3 boundaries. In this case, server to server connectivity within the same VLAN would not visible in the Netflow export. Please consult with your network device manufacture for details on Netflow support and configuration requirements. We recommend limiting the number of Netflow sources reporting to a single RN50 to 20 (10 for busy environments); if you have many Netflow sources multiple RN50s may be deployed for a single assessment.


Overview

This document will provide step-by-step instructions on deploying the Virtual RN50 appliances for use in traffic collection including VMware vSphere Virtual Switch Promiscuous mode, Distributed Virtual Switch Port Mirroring, SPAN (Port Mirroring), and NetFlow. Instructions for netstat collection are also included. The specific configuration depends on conditions in the environment, and we will cover the individual steps involved for each use-case. The possible use-cases are detailed below.


  • Promiscuous-Mode Mirroring will expose inter-VM traffic on a VMware virtual switch PortGroup for collection by the RN50 virtual appliance. It is similar to using Port Mirroring on a physical switch to collect mirrored traffic using SPAN, yet is specific to the VMware virtual switch. Traffic flowing through the virtual switch will be mirrored, and captured by the RN50 virtual appliance.
  • VDS Port Mirroring will expose inter-VM traffic on a VMware distributed virtual switch (dvSwitch) for collection by the RN50 virtual appliance. Traffic flowing through the VDS will be mirrored, and captured by the RN50 virtual appliance.
  • SPAN (Switched Port Analyzer), copies traffic from one or more ports, one or more EtherChannels, or one or more VLANs and sends the copied traffic for analysis to the Virtual RN50 virtual appliance.
  • Application Socket Collection, Netstat is a utility for reporting statistics from the operating system network stack. This utility has been implemented for virtually every major operating system, including Microsoft Windows NT, GNU/Linux, Apple OS X, BSD, and Oracle/Sun Solaris. Most implementations can report on a wide range of statistics, but the most common use of the utility is to provide a list of listening ports or active connections.
  • NetFlow is a protocol designed for network monitoring. It aggregates traffic statistics based on layer 3 and layer 4 flow information in order to determine the top talkers in the environment, and to describe the various protocols and interactions taking place. Devices with NetFlow enabled will gather and record flow statistics and periodically push this data to the RN50. Because NetFlow data is aggregated, and does not include packet contents, the relative volume of data is small.

On this page:

VMware Traffic Collection


Deploying TrafficWatch** will require a standard assessment using the RN150 virtual appliance. An existing, running, assessment can be used, or a new assessment can be created. TrafficWatch will require the RN150 appliance for command-and-control, as well as for data uploads to the RISC Networks NOC for final report generation (FlexPod assessment data will remain onsite). The RN50 appliance is used to collect mirrored traffic from the virtual switch, so an RN50 appliance will need to be deployed on each ESX/vSphere host, or one appliance per virtual switch. The RN50 appliances will require connectivity with the RN150 appliance.


If VLANs are in use in the environment, additional steps may be required. The VMware vSwitch or VDS port groups must be configured appropriately in order to collect mirrored traffic from VLANs. There are four use-cases:

  1. VLANs are not in use in the environment
  2. VLANs are in use, but traffic is only collected from one particular VLAN
  3. VLANs are in use, and untagged traffic is permitted in the environment
  4. VLANs are in use, and untagged traffic is NOT permitted in the environment

Details on configuration for each use-case are provided below. The specific steps involved are different depending on whether the classic vSwitch or the Distributed Virtual Switch (VDS) is in use. The step-by-step instructions to follow are broken up into two sections depending on which VMware switching technology is in use. In any case, the initial deployment steps are the same.


**Please note enabling Promiscuous Mode on a VSS (depending on configuration) will expose all guest VM traffic on that vSwitch and can be considered a security risk. Please consult your VMware administrator for policies regarding exposing server traffic.

Downloading the RN50

Browse to the web portal at https://portal.riscnetworks.com/login.php and log in

 


Access the assessment by selecting the assessment name.


 



 Select Collect Data menu >>> select Flow / Dependency Data

 

Select Download RN50 Appliance

Deploying the RN50 Virtual Appliance

  1. Connect to the ESX host or vCenter via the vSphere Client
  2. In the vSphere client, select File, then Deploy OVF Template
  3. Browse to the location of the unzipped RN50 download
  4. Select the MyIT-RN50-Virtual-Appliance2.0.ovf file
  5. Continue to deploy the virtual appliance according to local standards
    1. The RN50 OVF defines the basic requirements of the appliance
      • 2GB disk allocation (thick or thin provisioned)
      • 2GB memory allocation
    2. Accepting the defaults is recommended
  6. Select the appropriate Destination Network
  7. Select Finish to finish the deployment
  8. Power on the appliance
  9. Access the appliance via the VMware console
  10. Continue with DHCP or set a static IP configuration by selecting Edit in the Interfaces section.
  11. Access the RN150 section
  12. Select TrafficWatch from the drop-down list and select Proceed
  13. Select Proceed
  14. Enter the IP address of the RN150 appliance and select Add
  15. Test the connection
  16. The RN50 appliance is now ready to collect NetFlow/ESX traffic/Port Mirroring.

Configuring the vSphere Virtual Switch (vSwitch) for Promiscuous Mode Capture

Use-Case: No VLANs in use

 

Promiscuous mode can be configured on the vSwitch**, PortGroup, or VMKernel. Configuring promiscuous mode on the vSwitch allows all portgroups to see other VM traffic. Configuring promiscuous mode on the portgroup only allows VMs in that portgroup to see other VM traffic on the vSwitch.

**Please note enabling Promiscuous Mode on a VSS (depending on configuration) will expose all guest VM traffic on that vSwitch and can be considered a security risk. Please consult your VMware administrator for policies regarding exposing server traffic.


Each vSwitch PortGroup defaults to a VLAN ID of 0, (traffic is not tagged). The RN50 virtual appliance will be able to collect traffic from any VM connected to a Port Group set with a VLAN ID of 0. The vSwitch PortGroup must be configured for Promiscuous-Mode. The steps to do so are as follows:

  1. In the vSphere client, Select the ESX host
  2. Select the Configuration tab
  3. Select the Networking link under Hardware
  4. Select vSphere Standard Switch
  5. Select the Properties link
  6. The vSwitch configuration page should now be visible
  7. Select the vSwitch PortGroup the virtual appliance is assigned to
  8. Select Edit
  9. Select the Security tab
  10. Check the box next to Promiscuous Mode
  11. Select Accept on the Promiscuous Mode drop-down list
  12. Select Ok

Collecting Traffic from a Single VLAN Port Group

If VLANs are in use but the RN50 appliance is only intended to collect traffic from VMs on one particular VLAN, then the RN50 appliance needs to be connected to the Port Group that is configured for that VLAN.

  1. In the list of guest Virtual Machines select and right click the RN50 virtual appliance.
  2. Select Edit Settings
  3. Select Network Adapter
  4. In the Network Connection section, select the Port Group associated with the appropriate VLAN
  5. Select Ok

VSphere vSwitch Traffic Collection from multiple VLANs where untagged traffic is permitted in the environment

If VLANs are in use in the environment and the RN50 appliance is intended to collect traffic from all VLANs, the appliance must be configured to connect through a Port Group set to VLAN ID 4095. This is a VMware-specific VLAN ID that is untagged, yet allows for communication with VMs on all VLANs within the vSwitch. If a PortGroup configured for VLAN ID 4095 already exists, then a new Port Group need not be created.

The steps for configuration are as follows:

  1. Access the vSwitch Networking Properties
  2. In the vSphere client, Select the ESX host
  3. Select the Configuration tab
  4. Select the Networking link under Hardware
  5. Select vSphere Standard Switch
  6. Select the Properties link
  7. Select Add
  8. Select Virtual Machine (default selection)
  9. Define Network Label (Name the PortGroup)
  10. Enter 4095 in the VLAN ID section
  11. Select Next
  12. Select Finish
  13. Return to vSwitch properties
  14. Highlight the 4095 PortGroup
  15. Select Edit
  16. Select the Security Tab
  17. Place a check mark next to Promiscuous Mode: and ensure Accept is selected in the dropdown menu.
  18. Select Ok
  19. Select Close

VSphere vSwitch Traffic Collection from multiple VLANs where untagged traffic is NOT allowed in the environment.

If VLANs are in use and the RN50 appliance is intended to collect traffic from all VLANs, yet untagged traffic is not permitted in the environment, extra configuration is necessary. First, the appliance needs to be configured to connect through a Port Group set to VLAN ID 4095. This is a VMware-specific VLAN ID that is untagged, yet allows for communication with VMs on all VLANs within the vSwitch. In this configuration the RN50 appliance will not be able to communicate across the environment with the RN150 appliance, so an additional interface must be created and configured on the RN50 appliance. If a Port Group configured for VLAN ID 4095 already exists, a new Port Group need not be created.

The steps for configuration are as follows:

Create VLAN PortGroup 4095

The steps for configuration are as follows:

  1. Access the vSwitch Networking Properties
  2. In the vSphere client, Select the ESX host
  3. Select the Configuration tab
  4. Select the Networking link under Hardware
  5. Select vSphere Standard Switch
  6. Select the Properties link
  7. Select Add
  8. Select Virtual Machine (default selection)
  9. Select Next
  10. Define Network Label
  11. Enter 4095 in the VLAN ID section
  12. Select Next
  13. Select Finish
  14. Return to vSwitch properties
  15. Highlight the 4095 PortGroup
  16. Select Edit
  17. Select the ‘Security’ Tab
  18. Place a check mark next to Promiscuous Mode: and ensure Accept is selected in the dropdown menu.
  19. Select Ok
  20. Select Close

Enable the RN50 Virtual Appliance Virtual Network Interfaces

Configure Interface 1

  1. In the list of guest Virtual Machines select and right click the RN50 virtual appliance.
  2. Select Edit Settings
  3. Select Network Adapter 1
  4. In the Network Connection section, select the VLAN 4095 Port Group
  5. Select Ok


Configure Interface 2

  1. In the list of guest Virtual Machines select and right click the RN50 virtual appliance.
  2. Select Edit Settings
  3. Select Network Adapter 2
  4. In the Network Connection section, select the Port Group with access to the RN150 virtual appliance.
  5. Select Ok

VSphere DVS Port Mirroring Configuration

An RN50 virtual appliance will need to be deployed on each ESX host you wish to collect guest VM traffic

The steps for configuration are as follows:

  1. Access vSphere Client
  2. Select Home
  3. Select Networking
  4. Select the Ports tab
  5. Record and save the Port ID numbers for each VM that you wish to include for collection
  6. Record and save the Port ID numbers for each RN50 virtual appliance deployed.
  7. Right select the dvSwitch and select Edit Settings.
  8. Select the Port Mirroring tab
  9. Select Add
  10. Supply the Port Mirroring Session Name and Description
  11. Select Allow normal IO on destination ports
  12. Select Next
  13. Enter the Source Port IDs (Port IDs recorded in step 5)
  14. Add the Source Port IDs by selecting >>
  15. Enter the Destination Port IDs (Port IDs recorded in step 6)
  16. Add the Source Port IDs by selecting >>
  17. Enable Port Mirroring
  18. Select Finish
  19. Verify Port Mirroring Session


SPAN Configuration

(SPAN configuration may vary depending on the device. Please consult your manufacturer’s documentation for further information regarding port mirroring support for your device.)


  1. Switch# configure terminal (Enter global configuration mode.)
  2. Switch(config)# monitor session session_number source interface interface-id [, | -] [both | rx | tx]


  • Specify the SPAN session and the source port (monitored port).
  • For session_number, specify 1.
  • For interface-id, specify the source port to monitor. Valid interfaces include physical interfaces and port-channel logical interfaces (port-channel port-channel-number).
  • (Optional) [, | -] Specify a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen.
  • (Optional) Specify the direction of traffic to monitor. If you do not specify a traffic direction, the source interface sends both sent and received traffic.
  • both—Monitor both received and sent traffic.
  • rx—Monitor received traffic.
  • tx—Monitor sent traffic.


  1. Switch(config)# monitor session session_number destination interface interface-id [encapsulation {dot1q}]
  • Specify the SPAN session and the destination port (monitoring port).
  • For session_number, specify 1.
  • For interface-id, specify the destination port. Valid interfaces include physical interfaces.
  • (Optional) Specify the encapsulation header for outgoing packets. If not specified, packets are sent in native form.
  • dot1q—Use 802.1Q encapsulation.


  1. Switch(config)# end (Return to privileged EXEC mode)
  2. Switch# show monitor [session_number} (Verify your entries)
  3. Switch# copy running-config startup-config (Optional, save your entries in the configuration file.)

Configure Virtual RN50 for SPAN Collection on VMware Workstation

A virtual RN50 appliance will need to have 2 vNICs configured, 1 vNIC bridged to the Network and 1 vNIC bridged to the SPAN port. Configuration may vary depending the host machine and current VMnet settings on VMware Workstation.

  1. Open VMware Workstation
  2. Select Edit
  3. Select Virtual Network Editor
  4. Highlight VMnet 0
  5. Ensure VMnet Information is set to Bridged
  6. Set Bridged to: to NIC connected to SPAN port on physical switch
  7. Select Add Network (VMware Workstation will populate next available VMnet)
  8. Select OK
  9. Highlight created VMnet
  10. Change VMnet Information to Bridged
  11. Set Bridged to: to NIC with network access (RN50 appliance must have network access to the RN150 appliance)
  12. Select Apply
  13. Select OK
  14. Select Open Virtual Machine
  15. Browse to RN50 folder and select the OVF file
  16. Select Open
  17. Name Virtual Appliance (Optional)
  18. Select Import
  19. Select Edit Virtual Machine Settings
  20. Highlight Network Adapter
  21. Select Custom in the Network Collection field
  22. Select the VMnet in the dropdown box assigned to the NIC connected to the SPAN port of physical switch
  23. Select Add
  24. Select Network Adapter
  25. Select Next
  26. Select Custom in the Network Collection field
  27. Select the VMnet in the dropdown box assigned to the NIC that has network access to the RN150
  28. Select Finish
  29. Select OK
  30. Power on VM

Successful SPAN configuration will result in the IP address of the RN50 displayed as Mirrored for Collection Type in the TrafficWatch Stats in the RISC portal

NetFlow Version 5 Configuration

Cisco includes NetFlow version 5 support on many devices. Please refer to the documentation for your specific devices to determine if they support NetFlow.


NetFlow can be a powerful tool in a RISC Networks TrafficWatch engagement. When deploying NetFlow for TrafficWatch, the RN50 virtual appliance is configured as the NetFlow collector, and each exporter, the infrastructure device reporting NetFlow statistics, counts as a node towards the available node entitlement.


Quick Setup:

  1. Deploy RN150 as normal and start assessment
  2. Download and deploy RN50
  3. Select TrafficWatch
  4. Enter IP address of RN150
  5. Access devices that will export NetFlow
  6. Enable NetFlow version 5
  7. Configure NetFlow to export to the IP address of the RN50, port 9996
  8. Verify configuration in the portal
  9. Disable RN50 in portal

Configure device for NetFlow:

  1. Generic Cisco IOS commands (may vary depending on device):
  2. Router# configure terminal
  3. Router(config)# ip cef
  4. Router(config)# interface <interface> #For each participating interface
  5. Router(config-if)# ip route-cache flow #For each participating interface
  6. Router(config-if)# exit
  7. Router(config)# ip flow-export version 5
  8. Router(config)# ip flow-export destination <RN50 IP address> 9996
  9. Router(config)# end
  10. Verify collection of NetFlow statistics
  11. Router# show ip flow export
  12. Router# show ip cache [verbose] flow #Summarizes active flows, indicates how much NetFlow data is being exported

Verifying TrafficWatch Collection



  1. Browse to the web portal at https://cs-portal.riscnetworks.com/login.php and log in
  2. Access the assessment by selecting the assessment name
  3. Select Collect Data menu
  4. Select Flow / Dependency Data
  5. Verify each RN50 is associated to the assessment and Online
  6. Verify traffic is being recorded by each RN50 in the Flow Statistics section
  7. The Collection Type column will list the type of capture:
    1. NetFlow will display the IP address of the NetFlow exporting device
    2. Mirror capture indicates SPAN (port mirroring), Promiscuous Mode Capture (VSS Mirror), or DVS Port Mirroring
  8. Current collection can be verified in the Last Record Time (Record times will update on 10 minute intervals)


Please Contact help@riscnetworks.com if additional assistance is needed.