Contents

Configuring flow log· 1

Flow log configuration task list 3

Prerequisites for flow log configuration· 3

Specifying a flow log export destination· 3

Specifying a log host as the flow log export destination· 3

Specifying the information center as the flow log export destination· 4

Configuring the flow log version· 4

Specifying a source IP address for flow log packets· 4

Configuring the timestamp of flow logs· 5

Enabling load balancing for flow log entries· 5

Configuring flow log host groups· 5

About flow log host group· 5

Prerequisites· 6

Configuring an IPv4 flow log host group· 6

Configuring an IPv6 flow log host group· 6

Displaying and maintaining flow log· 6

Flow log configuration examples· 7

Example: Configuring flow log export 7

Example: Configuring flow log export to a flow log host group· 8

 

Configuring flow log

Flow log records users' access to external networks based on flows. Each flow is identified by a 5-tuple of the source IP address, destination IP address, source port, destination port, and protocol number.

Flow log creates entries based on NAT sessions. You can export these entries to the information center or log hosts.

Flow log has two versions: version 1.0 and version 3.0. Compared to version 1.0, version 3.0 of flow log provides flow statistics. Table 1 and Table 2 show the fields available in the versions.

Table 1 Flow log 1.0 fields

Field	Description
SrcIP	Source IP address before NAT.
DestIP	Destination IP address before NAT.
SrcPort	Source TCP/UDP port number before NAT.
DestPort	Destination TCP/UDP port number before NAT.
StartTime	Start time of the flow, in seconds.
EndTime	End time of the flow, in seconds. This field is 0 if the Operator field is 6 (regular connectivity check record for the active flow).
Protocol	Protocol number.
Operator	Reasons why a flow log entry was generated: ·     0—Reserved. ·     1—Flow was ended normally. ·     2—Flow was aged out because of aging timer expiration. ·     3—Flow was aged out because of configuration change or manual deletion. ·     4—Flow was aged out because of insufficient resources. ·     5—Reserved. ·     6—Regular connectivity check record for the active flow. ·     7—Flow was deleted because a new flow was created when the flow table was full. ·     8—Flow was created. ·     FE—Other reasons. ·     10-FE-1—Reserved for future use.
Reserved	Reserved for future use.

 

Table 2 Flow log 3.0 fields

Field	Description
Protocol	Protocol number.
Operator	Reasons why a flow log was generated: ·     0—Reserved. ·     1—Flow was ended normally. ·     2—Flow was aged out because of aging timer expiration. ·     3—Flow was aged out because of configuration change. ·     4—Flow was aged out because of insufficient resources. ·     5—Reserved. ·     6—Regular connectivity check record for the active flow. ·     7—Flow was deleted because a new flow was created when the flow table was full. ·     8—Flow was created. ·     FE—Other reasons. ·     10-FE-1—Reserved for future use.
IPVersion	IP packet version.
TosIPv4	ToS field of the IPv4 packet.
SourceIP	Source IP address before NAT.
SrcNatIP	Source IP address after NAT.
DestIP	Destination IP address before NAT.
DestNatIP	Destination IP address after NAT.
SrcPort	Source TCP/UDP port number before NAT.
SrcNatPort	Source TCP/UDP port number after NAT.
DestPort	Destination TCP/UDP port number before NAT.
DestNatPort	Destination TCP/UDP port number after NAT.
StartTime	Start time of the flow, in seconds.
EndTime	End time of the flow, in seconds. This field is 0 when the Operator field is 6 (regular connectivity check record for the active flow).
InTotalPkg	Number of packets received for the session.
InTotalByte	Number of bytes received for the session.
OutTotalPkg	Number of packets sent for the session.
OutTotalByte	Number of bytes sent for the session.
InVPNID	ID of the source VPN instance.
OutVPNID	ID of the destination VPN instance.
Reserved1 Reserved2 Reserved3	Reserved for future use.

 

Flow log configuration task list

Tasks at a glance
(Required.) Perform one of the following tasks for flow log export: ·     Specifying a log host as the flow log export destination ·     Specifying the information center as the flow log export destination
(Optional.) Configuring the flow log version
(Optional.) Specifying a source IP address for flow log packets
(Optional.) Configuring the timestamp of flow logs
(Optional.) Enabling load balancing for flow log entries
(Optional.) Configuring flow log host groups

 

Prerequisites for flow log configuration

Before you configure the flow log feature, complete the following tasks:

·     Enable NAT logging by using the nat log enable command.

·     Enable the following NAT logging features:

¡     Logging of active NAT flows (nat log flow-active).

¡     Logging of NAT session establishment events (nat log flow-begin).

¡     Logging of NAT session removal events (nat log flow-end).

For more information about the NAT logging commands, see Layer 3—IP Services Command Reference.

Specifying a flow log export destination

You can export flow log entries to a log host or the information center, but not both. If you configure both methods, the system exports flow log entries to the information center.

·     If the destination is a log host, flow log entries are sent as binary characters in UDP. One UDP packet can contain multiple log entries.

·     If the destination is the information center, flow log entries are converted to syslog entries in ASCII format, with the informational severity level. With the information center, you can specify multiple output destinations, including the console, log host, and log file. For more information about the information center, see "Configuring the information center."

Log entries in ASCII format are human readable. However, the log data volume is higher in ASCII format than in binary format.

Specifying a log host as the flow log export destination

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Specify a log host as the destination for flow log export.	userlog flow export [ vpn-instance vpn-instance-name ] host { hostname | ipv4-address | ipv6 ipv6-address } port udp-port	By default, no log hosts are specified. To specify multiple log hosts, repeat this step.

 

Specifying the information center as the flow log export destination

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Specify the information center as the destination for flow log export.	userlog flow syslog	By default, flow log entries are not exported.

 

Configuring the flow log version

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Configure the flow log version.	userlog flow export version version-number	The default flow log version is 1.0. Make sure the specified flow log version is supported on the log host. If you execute this command multiple times, the most recent configuration takes effect.

 

Specifying a source IP address for flow log packets

By default, the source IP address for flow log packets is the IP address of their outgoing interface. For the log hosts to filter log entries by log sender, specify a source IP address for all flow log packets.

As a best practice, use a Loopback interface's address as the source IP address for flow log packets. A Loopback interface is always up. The setting avoids export failure on interfaces that might go down.

To configure the source IP address for flow log packets:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Specify a source IP address for flow log packets.	userlog flow export source-ip { ipv4-address | ipv6 ipv6-address }	By default, the source IP address for flow log packets is the IP address of their outgoing interface.

 

Configuring the timestamp of flow logs

The device uses either the local time or the UTC time in the timestamp of flow logs.

·     UTC time—Standard Greenwich Mean Time (GMT).

·     Local time—Standard GMT plus or minus the time zone offset.

The time zone offset can be configured by using the clock timezone command. For more information, see Fundamentals Command Reference.

By default, the UTC time is used.

To configure the device to use the local time in the flow log timestamp:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Configure the device to use the local time in the flow log timestamp.	userlog flow export timestamp localtime	By default, the UTC time is used in the flow log timestamp.

 

Enabling load balancing for flow log entries

By default, the device sends a copy of each flow log entry to all available log hosts. When one log host fails, other log hosts still have complete flow log entries.

In load balancing mode, flow log entries are distributed among log hosts based on the source IP addresses (before NAT) that are recorded in the entries. The flow log entries generated for the same source IP address are sent to the same log host. If a log host goes down, the flow logs sent to it will be lost.

To enable load balancing for flow log entries:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enable load balancing for flow log entries.	userlog flow export load-balancing	By default, load balancing is disabled.

 

Configuring flow log host groups

About flow log host group

By default, the device sends a copy of each flow log entry to all available log hosts. To filter logs and reduce the log sending and processing workload of the device, configure the flow log host group feature.

The flow log host group feature allows you to classify flow log hosts into groups and specify an ACL for each group. A flow log matches a log host group if it matches the group's ACL, and it is sent only to the log hosts in the matching group.

If a flow log matches multiple log host groups, the device sends the log to the group that comes first in alphabetical order of the matching group names.

If a flow log does not match any log host groups, the device ignores the log host group configuration and sends the log to all configured log hosts.

If load balancing is enabled, flow logs sent to a log host group will be load-shared among the log hosts in the group. Flow logs generated for the same source IP address are sent to the same log host.

Prerequisites

Before you configure flow log host groups, complete the following tasks:

·     Configure the ACLs to be used by the flow log host groups.

·     Use the userlog flow export host command to configure the log hosts to be assigned to the flow log host groups.

Configuring an IPv4 flow log host group

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Create an IPv4 flow log host group and enter its view.	userlog host-group host-group-name acl { name acl-name | number acl-number }	By default, no IPv4 flow log host groups exist.
3.     Assign an IPv4 log host to the flow log host group.	userlog host-group [ vpn-instance vpn-instance-name ] host flow { hostname | ipv4-address }	By default, an IPv4 flow log host group does not contain any log hosts.

 

Configuring an IPv6 flow log host group

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Create an IPv6 flow log host group and enter its view.	userlog host-group ipv6 host-group-name acl { name acl-name | number acl-number }	By default, no IPv6 flow log host groups exist.
3.     Assign an IPv6 log host to the flow log host group.	userlog host-group [ vpn-instance vpn-instance-name ] host flow ipv6 { hostname | ipv6-address }	By default, an IPv6 flow log host group does not contain any log hosts.

 

Displaying and maintaining flow log

Execute display commands in any view.

 

Task	Command
Display flow log configuration and statistics.	display userlog export
Display flow log host group information.	display userlog host-group [ ipv6 ] [ host-group-name ]
Clear flow log statistics.	reset userlog flow export

 

Flow log configuration examples

Example: Configuring flow log export

Network configuration

As shown in Figure 1, configure flow log on the device to send flow log entries generated for the user to the log host.

Figure 1 Network diagram

 

Procedure

# Configure IP addresses, as shown in Figure 1. Make sure the device, user, and the log host can reach one another. (Details not shown.)

# Enable NAT logging.

<Device> system-view

[Device] nat log enable

# Enable NAT logging for session establishment events, session removal events, and active flows.

[Device] nat log flow-begin

[Device] nat log flow-end

[Device] nat log flow-active 10

# Set the flow log version to 3.0.

[Device] userlog flow export version 3

# Specify the log host at 1.2.3.6 as the destination for flow log export. Set the UDP port number to 2000.

[Device] userlog flow export host 1.2.3.6 port 2000

# Specify 2.2.2.2 as the source IP address for flow log packets.

[Device] userlog flow export source-ip 2.2.2.2

[Device] quit

Verifying the configuration

# Display the flow log configuration and statistics.

<Device> display userlog export

Flow:

  Export flow log as UDP Packet.

  Version: 3.0

  Source ipv4 address: 2.2.2.2

  Source ipv6 address:

  Log load balance function: Disabled

  Local time stamp: Disabled

  Log host numbers: 1

 

  Log host 1:

    Host/Port: 1.2.3.6/2000

    Total logs/UDP packets exported: 112/87

Example: Configuring flow log export to a flow log host group

Network configuration

As shown in Figure 2, configure a flow log host group on the device to send flow log entries generated for the user only to Log Host 1.

Figure 2 Network diagram

 

Procedure

# Configure IP addresses, as shown in Figure 2. Make sure the device, user, and the log host can reach one another. (Details not shown.)

# Enable NAT logging.

<Device> system-view

[Device] nat log enable

# Enable NAT logging for session establishment events, session removal events, and active flows.

[Device] nat log flow-begin

[Device] nat log flow-end

[Device] nat log flow-active 10

# Specify Log Host 1 and Log Host 2 for flow log export.

[Device] userlog flow export host 1.1.1.2 port 2000

[Device] userlog flow export host 2.2.2.2 port 2000

# Specify 3.3.3.3 as the source IP address for flow log packets.

[Device] userlog flow export source-ip 3.3.3.3

# Create ACL 2000 to match packets sent by the user.

[Device] acl basic 2000

[Device-acl-ipv4-basic-2000] rule 1 permit source 169.1.1.2 0.0.0.0

[Device-acl-ipv4-basic-2000] quit

# Create an IPv4 flow log host group named test and specify ACL 2000 for it.

[Device] userlog host-group test acl number 2000

# Assign Log Host 1 to flow log host group test.

[Device-userlog-host-group-test] userlog host-group host flow 1.1.1.2

[Device-userlog-host-group-test] quit

Verifying the configuration

# Display information about flow log host group test.

[Device] display userlog host-group test

Userlog host-group test:

  ACL number: 2000

 

  Flow log host numbers: 1

 

     Log host 1:

       Host/port: 1.1.1.2/2000

# After the user comes online, display flow log export statistics.

[Device] display userlog export

Flow:

  Export flow log as UDP Packet.

  Version: 1.0

  Source ipv4 address: 3.3.3.3

  Source ipv6 address:

  Log load balance function: Disabled

  Local time stamp: Disabled

  Log host numbers: 2

 

  Log host 1:

    Host/Port: 1.1.1.2/2000

    Total logs/UDP packets exported: 13/13

 

  Log host 2:

    Host/Port: 2.2.2.2/2000

    Total logs/UDP packets exported: 0/0