Monitoring VPN Performance

MPLS VPN Solution makes NetFlow "MPLS-aware." Thus, different service provider Customers can use the same IP address space, and MPLS VPN Solution can track the traffic flows for each individual VPN and Customer.

To use NetFlow and MPLS VPN Solution software to gather flow statistics, you must complete the following tasks:

• Set up the service provider network for NetFlow accounting.

• Make the appropriate settings and configuration elements on each NetFlow Collector device in the service provider network.

• In the MPLS VPN Solution software VPN Console, add the NetFlow Collector devices to the service provider network and enable NetFlow accounting.

ip flow-export version 5

ip flow-export destination ip_address port

---

Note The Version and Port parameters set on the PEs must be identical to the settings configured in the NetFlow Collector device.

---

ip route-cache flow

show ip cache flow

The output for this command shows the size of the packets, types of traffic, which interfaces the traffic enters and exits, as well as the source and destination addresses.

ip flow-cache entries #

The ip flow-cache entries command is a global command executed on the PE.

The default size of the NetFlow cache is usually adequate. However, you can increase or decrease the number of entries maintained in the cache to meet the needs of your flow traffic rates. For environments with a high amount of flow traffic (such as an Internet core router), a larger value such as 131072 (128K) is recommended. To obtain information on your flow traffic, use the show ip cache flow command.

The default is 64K flow cache entries. Each cache entry is approximately 64 bytes of storage. Assuming a cache with the default number of entries, approximately 4 MB of DRAM would be required. Each time a new flow is taken from the free flow queue, the number of free flows is checked. If there are only a few free flows remaining, NetFlow attempts to age 30 flows using an accelerated timeout. If there is only one free flow remaining, NetFlow automatically ages 30 flows regardless of their age. The intent is to ensure free flow entries are always available.

Caution Cisco recommends that you do not change the NetFlow cache entries. Improper use of this feature could cause network problems. To return to the default NetFlow cache entries, use the no ip flow-cache entries global configuration command.

1. When you install NetFlow on the NetFlow Collector (NFC) device, configure a local user name and password. MPLS VPN Solution software uses this NFC user name and password to communicate with the NFC device.

2. After NetFlow Collector 3.0 is installed, two configuration files must be modified so that MPLS VPN Solution software can import traffic data from the NFC device---the nf.resources file and the nfconfig.file. Both files are located on the NFC device at /opt/CSCOnfc/config.

#Set format to Comma Separated for VPNSC:
CSV_FORMAT yes
#Use long file names with dates:
LONG_OUTPUTFILE_SUFFIX yes

#Use the Detail Call Record aggregation scheme for VPNSC:
Thread DETCALLREC
Aggregation DetailCallRecord
Period 30
Port 9996
State Active
DataSetPath /opt/CSCOnfc/Data
Binary Yes
Compression No
Max Usage 100

---

Note Without these statements in the nfconfig.file, the VPN accounting reports cannot display information.

---

Tips Cisco recommends that you schedule MPLS VPN Solution to collect data from the NetFlow Collector devices every three hours.

To collect VPN accounting data, follow these steps:

Step 2 The first window is informational. Click Next to continue.

Step 3 From the Network drop-down menu, select the name of the network that the NetFlow Collector devices are in.

The upper panel displays all the available NetFlow Collector devices in the specified network.

Step 4 Click Add All.

The active list of NetFlow Collector devices is displayed in the lower panel.

If you need to remove some of NetFlow Collector devices from the active list, select the appropriate device and click Remove to remove a specific device; or click Remove All to remove all the NetFlow Collector devices from the active list.

When you are ready to choose the NetFlow Collector devices in the lower panel, click Next.

Step 5 Provide a unique task name for the data collection operation, then click Next.

The task name you enter here is listed in the Task Manager window and the Task Logs.

Defining the Data Collection Schedule

Note Do not click Add until you have set all the other scheduling information in the Schedule window.

Step 7 To set the collection frequency schedule to once every three hours, click the Hourly radio button.

Step 8 In the Start Time fields, set the time you want MPLS VPN Solution to start collecting data from the NetFlow Collector devices.

Note Be sure to set the start time no less than fifteen minutes ahead of the current time.

Step 9 In the Every hour(s) drop-down menu, select 3.

Step 10 Set the duration of the collection task.

• If you want to limit the duration of the collection task, click the End On drop-down menu and specify the desired date you wish to end the collection task.

• If you want to collect data continuously, set the End Time as No End.

For detailed information about scheduling, refer to Chapter 11, "Scheduling," in the Cisco VPN Solutions Center: MPLS Solutions User Reference.

Step 11 Click Next to initiate and save the accounting collection task.

You are informed that all the steps are done.

Step 12 Click Close to close the wizard.

The time-based reports are as follows:

Displays total packets and total KB for traffic that can be mapped to the VPN (VPN Traffic) and otherwise to Unmappable Traffic.

Provides total packets and total K bytes for each application type.

Provides total packets and total KB for each customer plus additional reports for customer site and application type.

Reports on all traffic between PE to PE, plus additional reports for the following: 1) PE to connected CE, 2) PE to remote CE, 3) PE traffic, and 4) PE to CE.

Provides total packets and total KB for each type of service.

Provides information on all traffic volume for a specific customer between CE to CE in packets or KB (by type of service).

Provides information on all traffic volume between PE to PE in packets or KB (by type of service).

Provides information on all traffic between PE to CE (by TOS).

Note For more detail about the data provided in the reports and how to get to the specific information that you require, refer to "View Accounting Reports" in Chapter 8 of the Cisco VPN Solutions Center: MPLS Solutions User Reference.

Step	Command	Description or Task
1	> telnet routername	routername is the name of the router you are checking.
2	Router> enable Router> enable-password	Enter enable mode and enter the enable password.
3	Router# show snmp
4		Check the output to see whether the following statement is present: SNMP agent not enabled
5	Router# configure terminal	Enter global configuration mode. You can also abbreviate the command to config t.
6	Router(config)# snmp-server community userstring RO	Set the community read-only string.
7	Router(config)# snmp-server community userstring RW	Set the community read-write string
8	Router(config)# Ctrl+Z	Return to privileged Exec mode.
9	Router# copy running startup	Save the configuration changes to NVRAM.

Tips The SNMP strings defined in the MPLS VPN Solution target password database must agree with those set on each router in the service provider network. The procedure for setting the SNMP community strings in the MPLS VPN Solution software is described in the "Completing the Target Information for Individual Targets" section.

The SLA server collects the relevant performance data, stores it persistently, and presents useful reports. The SLA server is based on the Service Assurance Agent (SA Agent) MIB. The MPLS VPN Solution software leverages the SA Agent MIB to monitor SLA performance. Service providers can monitor network traffic using any of the following protocols:

• Internet Control Message Protocol Echo (ICMP Echo)

• Transmission Control Protocol Connect (TCP Connect)

• User Datagram Protocol Echo (UDP Echo).

• Jitter (voice jitter)

• Dynamic Host Configuration Protocol (DHCP)

• Hyper text Transfer Protocol (HTTP)

• Domain Name System (DNS)

---

Note The command syntax does not reflect the current terminology for the SA Agent. The terms "rtr" and SA Agent are equivalent.

---

To enable the rtr responder software, enter the following command on each CE router that is running the SA Agent:

rtr responder

service udp-small-servers

4. PEs and CEs in the Customer's VPN must be able to communicate with the HTTP server in the service provider network.

• Assigned to the appropriate Customer(s).

• Configured for a valid VPN.

In addition, you must verify that the targets are assigned and the IP addresses are populated into the Device Inventory Repository for each target that is a source or destination for an SLA probe.

Tips  The SA Agent can gather performance information from CEs only when they are managed CEs. Make sure that when you add a CE to VPN Customer that the CE is configured as a managed CE with either Regular SA Agent status or Shadow SA Agent status enabled. For information on modifying an existing CE definition to enable SA Agent, see the "Editing Customer Site and Site CE Definitions" section.

To verify router targets and IP addresses in the Device Inventory Repository, follow these steps:

Step 2 Select a row that lists the target router.

Step 3 From the Network window, choose Actions > Edit Target.

Step 4 Choose the IP Addresses tab.

Populating IP Address Information to the Device Inventory Repository

Step 2 Step through the Populate Interface Information wizard.

This wizard sets up a scheduled task that polls for information about router interfaces. It extracts the interface name, index number, and IP address and subnet mask for each interface. The collected interface information is stored with each router definition.

Step 3 If only a few IP address are missing, you can individually add IP addresses and click the Add button for each addition.

Step 2 The first wizard window is informational. Click Next to continue.

The Specify SLA Operation window appears.

Step 4 Select one or more source CEs for the SLA probe, then click Next.

To select multiple CEs from the list, hold down the Ctrl key and click the items.

The next window directs you to indicate the source IP address for the source CE.

Step 5 From the drop-down list, choose the IP address for the appropriate interface on the source CE. The name of the selected CE is displayed to the left of the IP address.

When finished, click Next.

The next window directs you to specify the common parameters for the SLA.

Step 6 Enter the values for the SLA parameters common to each of the SLA protocols, then click Next.

The fields in the SLA Common Parameters window are as follows:

The next window directs you to specify the type of SLA protocol and set its corresponding parameters.

Step 7 Select one or more SLA protocols and enter the values for the fields associated with them.

• Internet Control Message Protocol Echo (ICMP Echo)

• Transmission Control Protocol Connect (TCP Connect)

• User Datagram Protocol Echo (UDP Echo).

• Jitter (voice jitter)

• Dynamic Host Configuration Protocol (DHCP)

• Hyper text Transfer Protocol (HTTP)

• Domain Name System (DNS)

Note Be sure to select the appropriate Destination CE and the corresponding Destination IP Address. Then complete the other fields as necessary.

You can add additional protocols as desired.

Step 8 When finished specifying the SLA protocol probes, click Add. Then click Next.

For details on the parameters and values for each SLA protocol listed here, refer to "Provision SLA Definitions and Collect SLA Data" in Chapter 8 of the Cisco VPN Solutions Center: MPLS Solution User Reference.

Step 9 Enter the task name, then click Next.

Step 10 Choose the defaul, (Yes) to proceed to schedule the task, then click Next.

Step 11 From the Schedule window, set all the pertinent scheduling information, then click Add.

The SLA is added to the Schedule List (and displayed in the upper pane).

Step 12 Click Next twice, then click Close.

Step 2 The first wizard window is informational. Click Next to continue.

The Specify SLA Operation window is displayed. From this window, you can choose to create an SLA, delete an SLA, or collect data for SLA monitoring.

Step 3 Choose Collect Data for SLA Monitoring, then click Next.

Step 4 Choose the appropriate Customer from the Customer drop-down list.

Step 5 Choose the appropriate VPN from the VPN drop-down list.

Step 6 Select one or more CEs from which you want to collect SLA data, then click Next.

Step 7 Provide a unique task name, then click Next.

Step 8 You can choose to schedule the task.

For detailed information about scheduling, refer to Chapter 11, "Scheduling," in the Cisco VPN Solutions Center: MPLS Solutions User Reference.

Step 9 To save the SA Agent collection task, click Next.

If you chose to schedule the SA Agent collection task, that will also occur.

You are informed that all steps are done.

Step 10 Click Close to close the wizard.

Step 2 The first wizard window is informational. Click Next to continue.

Step 4 In the Customer and VPN drop-down lists, select the pertinent Customer name and VPN name.

The CE pane lists all the CEs in the selected VPN that are running SA Agent.

Step 5 Select the name of the source CE for the SLA probe you want to delete, then click Next.

The next window directs you to select the SLA you want to delete.

Step 6 Click the appropriate lines in the list to select the SLAs you want to delete, then click Next.

To select multiple items, hold down the Ctrl key and click each item you want to add.

Step 7 Enter the task name, then click Next.

Step 8 Choose the default (Yes) to proceed to schedule the task, then click Next.

Step 9 From the Schedule window, set all the pertinent scheduling information, then click Add.

The SLA deletion request is added to the Schedule List (and displayed in the upper pane).

Step 10 Click Next twice, then click Close.

Note For details on each type of SLA report, refer to "View SLA Reports" in Chapter 8 of the Cisco VPN Solutions Center: MPLS VPN User Reference.

The specific report types are as follows:

These reports are time-based reports that show the following parameters: Connectivity as a percentage, Maximum Delay in milliseconds, and Threshold Violation as a percentage. These parameters are available in annual, monthly, weekly, daily, and hourly reports. For each parameter, you can generate detailed reports that show more related parameters. The reports can be organized by source router (the source CE of the SLA), SLA identifier, customer name, or VPN name.

Displays statistics that are measured only by Voice Jitter SLAs originated in a selected router. The reports are time-based. They show hourly, daily, weekly, monthly, and annual data and can be organized by SLA ID, destination router, VPN, Customer, or Unspecified.

Displays statistics that are measured only by HTTP SLAs. The reports are time-based, and they show data in the following time increments: hourly, daily, weekly, monthly, and annually. Data can be organized by SLA ID, source router, VPN, or Customer.

The Summary HTTP Report displays the connectivity, maximum delay, and threshold violation (as in the Summary Report). The Stages HTTP Report displays the round trip time, timeouts, and the error distribution among different HTTP stages: DNS lookup, TCP connect, and Transaction.

• Customer Packet Drop (CE-CE) Report

Shows the packet drop percentage among CEs of a specific customer. This information is measured only for the SLAs with the jitter protocol. The reports are organized by class of service. The reports are annually, monthly, weekly, daily, and hourly. You can navigate along the time scale.

Shows the maximum, minimum, and average round-trip time (in milliseconds) among the CEs of a specific customer. The statistics are for all the probe types. The reports are organized by class of service. The reports are annually, monthly, weekly, daily, and hourly. You can navigate along the time scale.

Shows the packet drop percentage among all the shadow SA Agent CEs in the network. The network packet drop between PEs is measured by the shadow SA Agent CEs that are connected to the PEs. This information is measured only for the SLAs with the jitter protocol. The reports are organized by class of service. The reports are annually, monthly, weekly, daily, and hourly. You can navigate along the time scale.

Shows the maximum, minimum, and average round-trip time among shadow SA Agent CEs in the network. The statistics are for all the probe types. The reports are aggregated by class of service. The reports are annually, monthly, weekly, daily, and hourly. The user can navigate along the time scale.

Shows all the SLAs on the SA Agent routers from which data was collected. The SLA Definition report shows the SLA ID given to each SLA. SLAs in the report may have been deleted but are kept in the SLA Definition to match the old collected data.

CAR provides several fundamental capabilities:

• Traffic matching

CAR can identify traffic of interest for limiting access rate or setting the precedence (or both). Rate policies can be associated with one of the following:

• All IP traffic

• IP precedence (defined by a rate-limit access list)

• QoS group

• MAC address (defined by a rate-limit access list)

• IP access list (standard and extended)

• Traffic measurement

CAR utilizes a token bucket measurement mechanism. Tokens are inserted into the bucket at the committed rate. The depth of the bucket is the burst size. When traffic arrives at the bucket, if sufficient tokens are available, the traffic is said to conform and the corresponding number of tokens are removed from the bucket. If sufficient tokens are not available, the traffic is said to exceed. Note that unlike leaky bucket implementations, the token bucket does not delay the traffic.

• Configurable action policies

The network operator can specify policies to be executed for traffic, which either conforms to or exceeds a specified rate limit.

In the example, assume the network operator delivered a physical T3 link to the customer, but offered a less expensive 20 MBPS subrate service. The customer pays only for the subrate bandwidth, which can be upgraded with additional access bandwidth.

The CAR policy configured here limits the traffic rate available to the customer and delivered to the network to the agreed upon rate limit, plus providing the ability to briefly burst over the limit.

interface hssi 0/0/0
rate-limit output 200000000 24000 3200 conform-action transmit exceed-action drop
ip address 209.165.200.225 255.255.255.0

To verify the configuration and monitor CAR statistics, use the show interfaces rate-limit command:

Router# show interfaces hssi 0/0/0 rate-limit

The Task Manager window appears.

Step 2 From the Task Manager window, choose Actions > New Task.

The Task Chooser window appears.

Step 3 From the task list, choose Poll a Router's CAR MIB, then click OK.

This wizard creates a task to poll the selected Cisco routers for data from the CAR MIB.

Step 4 Click Next twice to step through the introductory windows.

The next window allows you to specify which devices to poll for CAR information.

Step 5 From the Network drop-down list, choose the pertinent network.

This window has two panels. The upper panel displays the routers in the selected network. The lower panel will display the routers you want to be polled for CAR data.

Step 6 From the upper panel, select the routers you want to be polled for CAR data.

• If you want all the routers to be polled, click Add All.

• If you want some routers, but not others, to be polled, select each router, then click Add.

When you click Add or Add All, the selected routers are displayed in the lower panel.

If you need to remove any of the routers from the lower panel, click Remove to remove individual routers; or click Remove All to remove the entire list from the lower panel.

Step 7 When finished defining the list of routers to be polled, click Next.

Step 8 Enter the task name, then click Next.

Step 9 Choose the default (Yes) to proceed to schedule the task, then click Next.

Step 10 From the Schedule window, set all the pertinent scheduling information, then click Add.

Tips Cisco recommends that you schedule the polling task to occur every fifteen minutes. This requires four separate tasks to be scheduled, each starting fifteen minutes apart and reoccurring every hour.

Note You may discover that you need to increase the frequency of polling for CAR data, depending on the speed of the device interfaces and the volume of traffic on the router that is being polled.

The polling request is added to the Schedule List (displayed in the upper pane).

Step 11 Click Next twice, then click Close.

An example of the potential substantial savings is a scenario in which a network has 200 routers but the configuration files for only 20 of the routers have changed. In this example, SmartCollector only collects the configuration files for the 20 that have changed rather than for all 200 routers. If on average only 10 percent of the routers have their configuration files changed between scheduled collections, each SmartCollection takes only 10 percent of the resources of a full collection.

Step 2 Step through the Populate Interface Information wizard.

This wizard sets up a scheduled task that polls for information about router interfaces. It extracts the interface name, index number, and IP address and subnet mask for each interface. The collected interface information is stored with each router definition.

This information is used to create the various accounting reports and to map the "config-change" traps to the appropriate routers.

This wizard configures selected Cisco routers to send "config-change" traps to the current MPLS VPN Solution workstation. This enables SmartCollection, through which configuration files are collected only from those routers whose configuration files have changed.

Note If configuration file collection tasks are running and you initiate SmartCollection by registering for traps, the PEs must be IOS version 12.x to return traps.

Step 2 Step through the wizard.