Netmon Docs · Device Configuration Guide

Huawei VRPv7.0.20

Configure Huawei VRP switches and routers to mirror traffic with an observing port and export flow data over NetStream (NetFlow) or sFlow.

Covers Huawei VRP-based gear: S-series campus switches (S1720/S2700/S5700/S6700/S7700, CloudEngine S-series) and AR-series branch routers. VRP uses local port mirroring (an “observing port” plus a per-port mirroring action) for SPAN, and NetStream (NetFlow v5/v9) or sFlow v5 for flow export.

Mirror traffic (SPAN)

VRP performs local port mirroring in two steps: define an observing port (the port physically cabled to Netmon), then bind one or more monitored ports to it, choosing inbound, outbound, or both directions. The observing port should be a dedicated port with no other service configured on it.

Enter the system view.
```
<HUAWEI> system-view
```
Define the observing port and point it at the interface cabled to the Netmon sniffer NIC. Use a unique observing-port index (1-4 depending on platform).
```
[HUAWEI] observe-port 1 interface <observing-interface>
```
Enter the interface whose traffic you want to copy (the monitored port).
```
[HUAWEI] interface <monitored-interface>
```
Bind the monitored port to the observing port and choose the direction. inbound copies received packets, outbound copies sent packets, both copies both.
```
[HUAWEI-<monitored-interface>] port-mirroring to observe-port 1 both
```

(Optional) Repeat step 4 on additional monitored ports to mirror many ports to the same observing port (1:N mirroring).

[HUAWEI] interface <another-monitored-interface>
[HUAWEI-<another-monitored-interface>] port-mirroring to observe-port 1 inbound

Return to the user view and save.
```
[HUAWEI] quit
<HUAWEI> save
```

Note

The observing port forwards a verbatim copy of the monitored traffic. Cable it directly to the Netmon NIC that is set to Sniffer (manual). AR routers use the same observe-port / port-mirroring to observe-port model. See Receiving the Data in Netmon.

Important

Dedicate the observing port to mirroring only — do not run other services on it, or mirrored traffic and service traffic will interfere. If the link to Netmon is slower than the aggregate of the monitored ports, mirrored frames are dropped at the observing port; mirror a single direction (inbound or outbound) to halve the load.

Source: S1720, S2700, S5700, and S6720 V200R011C10 Command Reference, V200R011C10 (Update Date 2021-10-30). https://support.huawei.com/enterprise/en/doc/EDOC1000178165/6bd51f84/mirroring-configuration-commands

Export flow data

VRP exports flow records two ways, and Netmon accepts either:

NetStream — Huawei’s NetFlow implementation. Original flows export as V5 or V9. Send these to Netmon on UDP 9996.
sFlow v5 — packet-sampling export. Send this to Netmon on UDP 6343.

Configure one of the two, not both. NetStream is shown first; the sFlow alternative follows.

NetStream (NetFlow v5 / v9) — UDP 9996

Enter the system view.
```
<HUAWEI> system-view
```
Set the export format. Use 9 for NetFlow v9 or 5 for NetFlow v5 (the VRP default for original flows is V5). V9 is recommended.
```
[HUAWEI] ip netstream export version 9
```
Point the exporter at Netmon. The second value is the destination UDP port — set it to 9996 so records reach the Netmon collector.
```
[HUAWEI] ip netstream export host <netmon-ip> 9996
```
Set the source address of the exported packets to the address Netmon knows this device by, so the records are attributed to the correct device.
```
[HUAWEI] ip netstream export source <device-ip>
```

Enter each interface you want to account for and enable collection on the desired direction(s).

[HUAWEI] interface <interface>
[HUAWEI-<interface>] ip netstream inbound
[HUAWEI-<interface>] ip netstream outbound

Return to the user view and save.
```
[HUAWEI] quit
<HUAWEI> save
```

Note

ip netstream export host takes an explicit UDP port; there is no implicit default that matches Netmon, so the 9996 argument shown above is required. On AR routers the same commands apply (e.g. ip netstream export host <netmon-ip> 9996, ip netstream export version 9, then ip netstream inbound on the WAN/LAN interfaces). See Receiving the Data in Netmon.

Important

Enable ip netstream inbound/outbound only on the interfaces you actually want accounted for. Enabling both directions on every interface can double-count traffic that transits the device.

sFlow v5 (alternative) — UDP 6343

Enter the system view.
```
<HUAWEI> system-view
```
Configure the sFlow agent IP — set it to the address Netmon knows this device by. This must be a valid unicast address already configured on a device interface.
```
[HUAWEI] sflow agent ip <device-ip>
```
Define the collector (collector id 1) and point it at Netmon. Huawei sends sFlow on UDP 6343 by default, which matches the Netmon sFlow port.
```
[HUAWEI] sflow collector 1 ip <netmon-ip>
```

Enter each sampled interface and bind it to the collector, enabling flow sampling and (optionally) tuning the sampling rate.

[HUAWEI] interface <interface>
[HUAWEI-<interface>] sflow flow-sampling collector 1
[HUAWEI-<interface>] sflow flow-sampling rate <rate>
[HUAWEI-<interface>] sflow flow-sampling inbound

Return to the user view and save.
```
[HUAWEI] quit
<HUAWEI> save
```

Note

If you must move the collector off the default port, append port <port-number> to the sflow collector command — but for Netmon leave it at 6343. A maximum of two sFlow collectors can be configured system-wide. See Receiving the Data in Netmon.

Source: CloudEngine S3700, S5700 and S6700 V600R023C10 Command Reference (sFlow Configuration Commands). https://support.huawei.com/enterprise/en/doc/EDOC1100368578/ed6389be/sflow-configuration-commands

PreviousMikroTik RouterOS NextPalo Alto PAN-OS