Specifications

ManualsBrandsCisco ManualsHome building and DecorNetwork Analysis Module 6000

101

102

103

104

105

106

107

108

109

110

Product Features 2-59

NAM / Traffic Analyzer v3.5 Tutorial

Product Features 2-59

NAM / Traffic Analyzer v3.5 Tutorial

Basic NAM-1/2 Configuration

Overview of Steps

Basic NAM-1/2 Configuration

Overview of Steps

NAM-1, NAM-2 Only

Step 1 – Defining the Data Sources

• SPAN Session Æ Data Port

• RSPAN Session Æ Data Port

• VACL Æ Data Port

• NetFlow Data Export (NDE) Æ NDE Data Port

• MPLS (import VRF, VCID, Labels)

• Supervisor Module (enable Mini-RMON)

Step 2 – Enabling Core Monitoring

• Turn on various types of statistics for different traffic sources seen by the NAM

• Traffic Sources:

• ALL SPAN (if multiple span sessions exist)

• Data Port (if using a NAM-2 module, specify which Data Port (1 or 2)

• Individual VLANs

• MPLS (VRF, VCID, Labels)

• NDE traffic (All or a subset)

• ERSPAN

• Supervisor (mini-RMON, VLAN stats)

• For each data source, different types of statistics can be enabled (Protocol, Hosts,

Conversations, VLAN statistics)

Basic NAM-1/2 Configuration – Overview of Steps

One of the keys to a successful NAM deployment is properly selecting and configuring data sources. The user

must understand that this is a two step process. First, data must be sent to the NAM for analysis, and secondly,

several monitoring options must be enabled for various subsets of the traffic sent to the NAM for analysis.

Data can be sent to the NAM-1/2 for analysis using the following methods. (Each of these will be discussed in

greater detail in the upcoming pages.)

• Spanning ports, VLANs, or Ether Channels to a NAM-1/2 data port; the NAM-2 has two data ports.

• VACL – Use the command line of the switch to forward packets from an interface.

• NDE – Forward NetFlow packets from a device to a special interface on the NAM-1/2.

At this point the data is being sent to the NAM, but not yet being analyzed. The second step is to turn on various

monitoring options (Enabling Monitoring) for different subsets of the forwarded traffic. The data sources provide

the traffic to the NAM for analysis. The traffic is analyzed and broken down into subsets of traffic (all traffic,

individual VLANs, individual MPLS tags, or subsets of NDE sources). The user will then configure the NAM to

monitor various types of statistics (applications, protocols, hosts, conversations, etc.) for these traffic sources.

TIP: Often times, if a report does not display any data, this can always be traced back to one of the following

configuration scenarios:

• The requested data is not currently being spanned to the NAM-1/2, but the subset of traffic is still enabled.

• The requested data is currently being spanned to the NAM-1/2, but the subset of traffic is not enabled.