Expired

XV. VigorACS and VigorConnect

Expired

VigorConnect - sFlow Setup Guide

Products:
VigorConnect
Keywords:
monitoring
packet sampling
sflow
vigorconnect
Show all

sFlow is a standard protocol designed to monitor the traffic flow by sampling packets.
In a business environment, where there is a great amount of traffic going through the network, the sFlow protocol can prove to be very useful for network administrators. It helps with detection of any abnormal traffic caused by congestion and potential attacks.

This article describes steps needed to configure sFlow on VigorConnect 1.5.0 (and later versions) with compatible DrayTek VigorSwitches.

The following switches support the sFlow feature:

VigorSwitchFirmware Required
G2280x 2.5.1 or later
G2540x 2.6.0 or later
P2280x 2.5.1 or later
P2540x 2.6.0 or later

How to start using sFlow to monitor the traffic

1. Enable sFlow on the switch

a) Select a Profile ID, e.g. 1
b) Set Enable Profile to Enable
c) Edit Packet Sampling if needed (400 by default)
Packet Sampling Rate means how many packets are captured. The higher the number, the better accuracy of the data.
d) Edit Counter Sampling Interval if needed (30 by default)
Counter Sampling Interval is the number of seconds before the next packet sample is being captured.
e) Select Collector Address Type (IPv4 of VigorConnect server used here)
f) Set Collector Address (VigorConnect server IPv4 address we use is 192.168.1.10)
g) Edit Collector Port if necessary (6343 by default)
h) Select All (or some specific) Data Source Ports
i) Press Apply to save the settings
kb vigorconnect sflow 13

2. Enable sFlow on VigorConnect
sFlow is disabled by default on VigorConnect. Right-click the VigorConnect icon in the system tray to see available menu options. You may need to press Stop first in order to access the Setup configuration page shown below.
Switch to Network Flow tab and Enable sFlow Counter Sampling Interval. Press OK. Then right-click again to Start VigorConnect.

kb vigorconnect sflow 01

3. Register a VigorSwitch to VigorConnect.

  1. Go to VigorConnect Dashboard and click the Discover button in the New Devices section.
    kb vigorconnect sflow 09
  2. When the scanning process is completed select the VigorSwitch that you want to manage with VigorConnect and use the Add button to add them to the network.
    kb vigorconnect sflow 10
  3. Then navigate to the Root Network drop-down section and select your switch
    kb vigorconnect sflow 12

4. Apply sFlow settings profile
Go to [Device Menu] > [Configuration] > [sFlow Settings]

a) Select the same Profile ID, e.g. 1
b) Set Enable Profile to Enable
c) Press Apply to save the profile.
The "update Profile Successful" message should appear

kb vigorconnect sflow 02

Monitor the traffic

Once sFlow is set up and collecting traffic information, go to [Device Menu] > [Monitoring] > [sFlow]

a) Device Overview


This page illustrates the outline of the traffic including the usage, frequency of each port/protocol/destination/source IP, and the statistics depicted in a form of the pie charts. The network administrator can select Destination and Source IP to analyse the traffic.

kb vigorconnect sflow 04

kb vigorconnect sflow 05

b) In the top right corner, the network administrator can choose time range and the frequency of the data being refreshed by VigorConnect

kb vigorconnect sflow 03

c) Device Port Status

This page focuses on the traffic of a selected port the network administrator wants to monitor.

Both, inbound and outbound flow usage can be monitored along with Flow Faults, In/Out Discards, In/Out Errors, In/Out Broadcast Packets, In/Out Multicast Packets. This is a great tool to assist with any troubleshooting networking issues.

kb vigorconnect sflow 06

kb vigorconnect sflow 07

d) Device Attack Detection


This page helps the network administrator to monitor the Flood Attack. sFlow can help to analyse multiple types of flood attacks

kb vigorconnect sflow 08


    How do you rate this article?

    1 1 1 1 1 1 1 1 1 1