Netmon Docs · Device Configuration Guide

Juniper Junos OSv7.0.20

Set up analyzer-based port mirroring and inline J-Flow export on Juniper EX/QFX switches and MX/SRX platforms so Netmon can see the traffic crossing them.

Covers Juniper devices running Junos OS: EX/QFX switches (local port mirroring via the analyzer feature) and MX routers / SRX firewalls (inline active flow monitoring, also called J-Flow). Commands are shown in Junos set form from the [edit] configuration mode; commit when finished.

Mirror traffic (SPAN)

On EX/QFX switches, local port mirroring is configured as an analyzer instance: you name the instance, attach one or more input interfaces (the traffic you want to watch), and point its output at the interface wired to the Netmon sniffer NIC. The syntax below is the ELS (Enhanced Layer 2 Software) form used on current EX/QFX platforms (EX2300/EX3400/EX4300 and later); legacy non-ELS switches use the ethernet-switching-options hierarchy shown at the end.

  1. Enter configuration mode.

    user@switch> configure
[edit]

  2. Define the analyzer input. Attach each interface you want to mirror and choose a direction (ingress, egress, or both). Repeat the line for additional source ports.

    [edit]
user@switch# set forwarding-options analyzer employee-monitor input ingress interface ge-0/0/0.0
user@switch# set forwarding-options analyzer employee-monitor input ingress interface ge-0/0/1.0

  3. Define the analyzer output: the interface connected to the Netmon sniffer NIC. Mirrored copies of all input traffic are sent here.

    [edit]
user@switch# set forwarding-options analyzer employee-monitor output interface ge-0/0/10.0

  4. Commit the configuration.

    [edit]
user@switch# commit
Note

On legacy (non-ELS) EX switches the equivalent commands live under ethernet-switching-options:

set ethernet-switching-options analyzer employee-monitor input ingress interface ge-0/0/0
set ethernet-switching-options analyzer employee-monitor output interface ge-0/0/10
Important

An analyzer output interface cannot also be a source (input) port, and it does not participate in Layer 2 protocols (such as STP). Dedicate the port that feeds the Netmon sniffer NIC; do not carry production traffic on it.

On the Netmon side, set the receiving NIC to Sniffer (manual) — see Receiving the Data in Netmon.

Source: Configuring Port Mirroring and Analyzers, Junos OS (Release 13.2X50-D10 or later). https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/port-mirroring-and-analyzers-configuring.html

Export flow data

MX routers (and SRX firewalls) export flow records using inline active flow monitoring (J-Flow), which is processed in the Packet Forwarding Engine. You define a flow-monitoring template (NetFlow v9 with version9, or IPFIX/v10 with version-ipfix), a sampling instance that names the Netmon collector as the flow-server, bind the instance to the FPC, and apply sampling to the interfaces or firewall filter you want to account.

The vendor example exports to UDP port 2055. Netmon listens for NetFlow/IPFIX on UDP 9996, so override the port to 9996 as shown below. Set the inline-jflow source-address to the address Netmon already knows this device by, so the exporter source matches the device’s record.

  1. Enter configuration mode.

    user@router> configure
[edit]

  2. Define the flow-monitoring template. Use version9 for NetFlow v9 or version-ipfix for IPFIX. Add the address family template (ipv4-template / ipv6-template) and timeouts.

    [edit]
user@router# set services flow-monitoring version9 template template1 flow-active-timeout 120
user@router# set services flow-monitoring version9 template template1 flow-inactive-timeout 60
user@router# set services flow-monitoring version9 template template1 template-refresh-rate packets 100
user@router# set services flow-monitoring version9 template template1 template-refresh-rate seconds 600
user@router# set services flow-monitoring version9 template template1 option-refresh-rate packets 100
user@router# set services flow-monitoring version9 template template1 option-refresh-rate seconds 600
user@router# set services flow-monitoring version9 template template1 ipv4-template

    For IPFIX export instead, use the version-ipfix hierarchy:

    [edit]
user@router# set services flow-monitoring version-ipfix template template-v61 ipv6-template
user@router# set services flow-monitoring version-ipfix template template-v61 flow-active-timeout 150
user@router# set services flow-monitoring version-ipfix template template-v61 flow-inactive-timeout 100

  3. Create the sampling instance. Set the flow-server to the Netmon appliance and override the port from the example’s 2055 to 9996. Bind the template and set inline-jflow source-address to the address Netmon knows the device by.

    [edit]
user@router# set forwarding-options sampling instance instance-1 input rate 1
user@router# set forwarding-options sampling instance instance-1 family inet output flow-server <netmon-ip> port 9996
user@router# set forwarding-options sampling instance instance-1 family inet output flow-server <netmon-ip> version9 template template1
user@router# set forwarding-options sampling instance instance-1 family inet output inline-jflow source-address <device-source-address>
user@router# set forwarding-options sampling instance instance-1 family inet output inline-jflow flow-export-rate 10

    For the IPv6 / IPFIX family, point the same collector at port 9996 with the IPFIX template:

    [edit]
user@router# set forwarding-options sampling instance instance-1 family inet6 output flow-server <netmon-ip> port 9996
user@router# set forwarding-options sampling instance instance-1 family inet6 output flow-server <netmon-ip> version-ipfix template template-v61
user@router# set forwarding-options sampling instance instance-1 family inet6 output inline-jflow source-address <device-source-address>

  4. Bind the sampling instance to the FPC and size the inline flow tables.

    [edit]
user@router# set chassis fpc 0 sampling-instance instance-1
user@router# set chassis fpc 0 inline-services flow-table-size ipv4-flow-table-size 8
user@router# set chassis fpc 0 inline-services flow-table-size ipv6-flow-table-size 7

  5. Apply sampling to the traffic. Create a firewall filter with the sample action and attach it to the interface(s) you want accounted — the interface attachment is shown in the cited Juniper example.

    [edit]
user@router# set firewall family inet filter inet-sample term t1 then sample
user@router# set firewall family inet filter inet-sample term t1 then accept

  6. Commit the configuration.

    [edit]
user@router# commit
Note

flow-server <netmon-ip> port 9996 is the line that points the exporter at Netmon. The vendor example ships with port 2055; if you copy it verbatim, no flow data reaches Netmon — always set port 9996.

Important

source-address under inline-jflow is the source IP of the exported flow packets. Set it to the address Netmon already monitors this device by; a mismatch makes the flow stream appear to come from an unknown exporter.

On the Netmon side, enable Allow Netflow Data Collection on the device record — see Receiving the Data in Netmon.

Source: Example: Configuring Inline Active Flow Monitoring on MX Series and T4000 Routers, Junos OS (Release 13.2 or later). https://www.juniper.net/documentation/us/en/software/junos/flow-monitoring/topics/example/inline-sampling-configuring.html

PreviousCisco Nexus (NX-OS) NextArista EOS