Interface Traffic Monitoring in U-Center 5.0

Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Document version: 5W100-20250827

 

Contents

Introduction· 1

Usage guidelines· 2

Prerequisites· 2

Configuration example· 3

Network configuration· 3

Configuring the switch· 3

Configuring U-Center 5.0· 4

Adding devices· 4

Managing parameters· 5

Adding a threshold template· 5

Adding an interface traffic analysis task· 7

Verifying the configuration· 9

Viewing interface traffic analysis data· 9

 

Introduction

U-Center 5.0 collects traffic log information sent by devices to perform statistics and analysis on network traffic. This document selects the NetStream log type to introduce the steps and analysis results for configuring interface traffic monitoring in U-Center 5.0.

 

Usage guidelines

Prerequisites

·     Install and deploy Unified Platform, U-Center 5.0 UCP, NTA, and NSM components.

·     Devices such as routers and switches support the NetStream log sending function.

·     Make sure the devices can communicate with the system.

·     Configure the SNMP community string and port number correctly on the device.

·     The deployment nodes and traffic reporting nodes for the NTA component match those of the UCP component.

·     The NTA device configuration varies by UCP deployment scenario.

¡     Full node deployment: UCP is deployed on all relevant nodes. In this case, you can configure a northbound IP address for all devices to enable comprehensive traffic monitoring and management, facilitating traffic analysis by the NTA component.

¡     Single-node deployment: UCP is deployed on one node only. In this case, due to the impact of UCP tags, only the IP address for that specific node can be configured.

 

Configuration example

Network configuration

As shown in Figure 1, a company uses the H3C S5800-32C switch as the core switch, with interface GE2/0/1 connecting to the external network and interface GE2/0/3 connecting to the U-Center 5.0 server. The IP address of the U-Center 5.0 server is 192.167.243.78/24. The switch uploads traffic information statistics to U-Center 5.0, allowing for monitoring of traffic across the entire network.

The server and device version information is as follows:

·     Unified Platform versions: UDTP (E7103), BMP (E7103)

·     U-Center versions: NTA (E7102), UCP (E7102), NSM_Res (E7102)

·     Switch software version: H3C Comware Platform Software, Software Version 5.20, Release 1809P11

Figure 1 Network diagram

 

Configuring the switch

# Enable NetStream for incoming traffic on GE2/0/1.

<H3C5800>system-view

[H3C5800]interface GigabitEthernet2/0/1

[H3C5800-GigabitEthernet2/0/1]ip netstream inbound

[H3C5800-GigabitEthernet2/0/1]quit

# Specify the U-Center 5.0 server as the destination host for NetStream data export.

[H3C5800]ip netstream export host 192.167.243.78 9020

By default, NetStream traditional data export uses the version 5 format. To use the version 9 format, execute the ip netstream export version 9 command in system view.

# Set the aging timer to 1 minute for active flows.

[H3C5800]ip netstream timeout active 1

# Set the aging timer to 10 seconds for inactive flows.

[H3C5800]ip netstream timeout inactive 10

# Specify GigabitEthernet 2/0/1 as the source interface for NetStream traditional data packets.

[H3C5800]ip netstream export source interface GigabitEthernet2/0/1

Configuring U-Center 5.0

Adding devices

1.     Log in to U-Center. 5.0 Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Traffic Configuration.

2.     Click the Device Management link.

3.     Click Add. The Add Device page opens, as shown in Figure 2.

Figure 2 Adding devices

 

4.     You can add devices by using either of the following methods:

¡     Manually add a device: Enter the IP address and device name, and click Select Parameter Template to select or add a parameter template. In this example, a device is added manually. The IP address is 192.167.1.133, and the device name is Switch133.

¡     Select devices from the list: Click Select Device to select devices.

5.     Device Description: Enter a description. In this example, no description is entered.

6.     SNMP Parameters: Click Select Parameter Template to select or add an SNMP template. In this example, SNMP template SNMPv2c_Config_Template is selected.

7.     NetStream Flow Identifier: This option is enabled by default. In this example, the default is used.

8.     NetStream New Feature: This option is enabled by default. In this example, the default is used.

9.     Click OK to add the device.

Managing parameters

1.     Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Traffic Configuration.

2.     Click the Parameters link.

3.     On the page, you can enable related features and configure traffic data settings. In this example, threshold alarming and baseline analysis are enabled, as shown Figure 3.

Figure 3 Enabling features

 

4.     After you enable a feature, click OK to save the configuration.

Adding a threshold template

1.     Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Traffic Configuration.

2.     Click the Threshold Templates link.

3.     Click Add to access the page for adding a threshold template, as shown Figure 4.

Figure 4 Adding a threshold template

 

4.     Configure the following basic information:

¡     Template Name: Enter Interface.

¡     Template Type: Select a template type. In this example, Interface Task is selected.

¡     Use the default settings for the other parameters.

5.     Configure threshold settings:

¡     Direction: Select a direction from the list. In this example, Incoming is selected.

¡     Traffic Threshold(Unit): Select a traffic unit. In this example, Mbps is selected.

¡     Alarm Settings: Select an alarm level, and set the traffic thresholds and the number of occurrences.

¡     Use the default settings for the other parameters.

6.     Click Add.

Adding an interface traffic analysis task

1.     Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Interface Traffic.

2.     On the Interface Traffic page, click Add to add an interface traffic analysis task, as shown in Figure 5.

Figure 5 Adding an interface traffic analysis task

 

3.     Configure the following basic information:

¡     Name: Enter InterfaceA.

¡     VLAN/VXLAN Traffic Analysis: Enable this option.

¡     Threshold Alarming: Enable this option. The Threshold Template field is displayed.

¡     Threshold Template: Click Select Threshold Template, and select an existing template or click Add to add a template.

¡     Baseline Analysis: Enable this option. The Automatic Baseline Anomaly Detection option and the Baseline Threshold Settings area are displayed.

¡     Automatic Baseline Anomaly Detection: Do not enable this option.

4.     Configure baseline threshold settings:

¡     Incoming Traffic Threshold: Enter 40%.

¡     Outgoing Traffic Threshold: Enter 30%.

5.     Configure interface information:

¡     Click Select Interfaces, and select GigabitEthernet2/0/1.

¡     Use the default settings for the other parameters.

6.     Click OK to add the interface traffic analysis task, as shown Figure 6.

Figure 6 Interface traffic analysis task list

 

Verifying the configuration

Viewing interface traffic analysis data

1.     Click the Monitor tab. From the left navigation pane, select Network Traffic Monitor > Interface Traffic. On the page, you can view traffic information for each interface traffic analysis task, including the alarm state, interface count, number of abnormal interfaces, inbound traffic size, outbound traffic size, and link usage.

2.     Click the InterfaceA link to view its traffic analysis information. The Traffic tab is displayed by default, as shown in Figure 7.

Figure 7 Interface analysis report for InterfaceA

 

3.     Click the Application tab to view the application analysis report for InterfaceA, as shown in Figure 8.

Figure 8 Application analysis report for InterfaceA

 

4.     Click the Source tab to view the source host analysis report for InterfaceA.

Figure 9 Source host

 

5.     Click the Destination tab to view the destination host analysis report for InterfaceA.

Figure 10 Destination host

 

6.     Click the Session tab to view the session analysis report for InterfaceA, as shown in Figure 11.

Figure 11 Session analysis report for InterfaceA