Highlighted
Respected Contributor.
Respected Contributor.
710 views

Clarification for flow collectors

Hi all

I have confusion over deploying iSPI for traffic. I have a Global and Regional manager set up. There is only little mentioned in deployment guide about traffic iSPI. It has that you can add Master Collector and Leaf Collectors that belong to a different regional manager to your local configuration as remote collectors. Fine. Alternatively is it possible to have just one leaf and master collector with no relation whatsoever to Regional Node Managers, and all flows coming in to this single collector (Master+Leaf)?

0 Likes
7 Replies
Highlighted
Outstanding Contributor.. Outstanding Contributor..
Outstanding Contributor..

Re: Clarification for flow collectors

Hi,

 there are few Traffic SOI deployment scenatrions. See attached

 

my 2 cents
Gedas

Highlighted
Respected Contributor.
Respected Contributor.

Re: Clarification for flow collectors

Thanks. It seems the last architecture is something close to what I am looking for. I want to understand is there really need for regional components- either master or leaf? Can't I just have one Spi having both and configured with global manager? BTW the global manager also has failover.
0 Likes
Highlighted
Outstanding Contributor.. Outstanding Contributor..
Outstanding Contributor..

Re: Clarification for flow collectors

Hi,

What is your network scale? One of the main drivers of your architecture/deployment  must be numbr of flow types (netflow, jflow etc.)  and number of the flows you are collectng and data traffic between IP-flow interface and Leaf. Also inportant is NPS data retention periods.  Could be that you can cope with "co-located SPI" scenario.

I'd suggest  you to evaluate traffic  with OOTB analysis tools like nnmtrafficflowanalysistool.ovpl and nmstrafficinspectiontool.ovpl.  1st one tool will propvide you with some guidance. about HW sizing and architecture e suggestions (number of leafs etc.)

In ideal scenario: Master can manage up to 5 Leaf Collectors Systems.  Each leaf flushing 600K raw flow records/min.
Best performance of the SPI Traffic is when no more than 3 logical Leaf Collectors are configured for each Leaf Collector system. Well.. In some scenarions 5 are sometimes acceptable.
It is mandatory to have one logical Leaf Collector configured for each flow type. That is, netflow, sflow, and IPFIX type of flow traffics should have one Leaf Collector configured each.
It is a good practice to forward the same type of flow traffic from multiple routers to the same port on the logical Leaf Collector system.


What is GM's  failover - HA cluster or Application failover?
AF resilience is not supported for Leaf and Master and no HA is not supported for Leaf.

regards
Gedas

0 Likes
Highlighted
Respected Contributor.
Respected Contributor.

Re: Clarification for flow collectors

The flows are yet to configure on nodes. Am still planning 🙂 (I presume the utilities ovpl will work on flows, right?)
However total interfaces on GM are around 14-15k & 5k approx on RM. They in application failover (not HA).
Thing is rest of system is already functioning with an NPS along side the GM. I have to have traffic additionally. So was wondering if just single one would do the job or leaf collectors are necessary on RM?
Thanks again!
0 Likes
Highlighted
Respected Contributor.
Respected Contributor.

Re: Clarification for flow collectors

Turns out it is possible after all. Its only suggested in interactive guide where it says both the collectors can be on the same remote standalone system. Just in case anyone was wondering ;). Here is design as well.

0 Likes
Highlighted
Outstanding Contributor.. Outstanding Contributor..
Outstanding Contributor..

Re: Clarification for flow collectors

Hi,

such single server /collector deployment is  typical for small scale production or staging environments. Shouel be OK if traffic flows in your environment are  up to 100-200k/min. Before the deployment you can evaluate real traffic flows by tools I already mentioned . Note:  nmstrafficinspectiontool.ovpl  is stand alone and not requires iSPI Traffic installation. It can be downloaded from MF SW portal.

regards
Gedas

0 Likes
Highlighted
Respected Contributor.
Respected Contributor.

Re: Clarification for flow collectors

Thanks for pointing that out, Gedas. Would cetainly have done that. Downloaded utility on earlier suggestion itself. Since flows are not generated at this moment, not sure of its usefulness. What I think is to go ahead, and if flow exceeds, will add another leaf on RNM. Hope that's ok.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.