LAN monitoring using my NNA server

[antorres]

Hi everyone.

I've got a situation and wanted to share with you. Currently I am monitoring jflow data from a Juniper SRX100 in one branch, but I'm still got some problems there (in that particular branch) regarding, bandwith usage, high internet latency among other problems. Therefore I need to see, check and monitor the LAN within my Juniper.

The Juniper SRX100 has a WAN IP of 172.22.xx.xx and that's my NNA source from which i receive jflow data.
The LAN IP addresses of the my Juniper are 10.0.232.xx and there's no more that 5 worstation.

How do I see the LAN trafic with my NNA? Only with a client? or there's another way?

I would really appreciate any help.

Thank you all in advance.

[tgriep]

The Nagios Network Analyzer only uses the source IP for capturing the flow data from that device but it doesn't use that IP address for filtering the data.
The NNA software is used to display the flow data that it receives from a device and you can use the NNA software to see bandwidth data but it will not show latency, etc..

If you want to only see the data from the LAN port, you would have to configure the Juniper to only send the from data from that port to the NNA server.

[antorres]

Hi tgriep, thank you for answering, Yes that's the problem I ran into, but I still wanna see the LAN trafic and what's going on in that particular branch, because the customers complain for the poor internet service, among others. How can I see at least the among of data the workstations send and receive. Only with an agent? is there any other way?

Thank you in advance.

[tgriep]

If you want to see the traffic generated by certain hosts / hosts in the flow data, you would create a query for the hosts you want to look at and run the queries against the source in NNA for that device.
Take a look at the following link for setting up queries and what they mean.
http://assets.nagios.com/downloads/nagi ... alyzer.pdf

[antorres]

Hi tgriep, me once again, I've run the query on the specific source (host) to see the LAN traffic, and once again the only traffic I see is the WAN traffic. In this particular case I don´t care about it. The main reason why my Client bought the NNA is to see what's going out in inside that branch, so they are very disappointed at this moment.

The equipment in that particular branch is an Juniper SRX100. Obviously the netflow configuration is set ok, that's why is all I see. Do I have to enable some kind of S-flow to see the LAN traffic trough my router. I will again appreciate any help to solve and overcome this issue.

Code: Select all

}
Flow Start	Flow End                                      	    Source IP	Destination IP	        Source Port	Destination Port
2017-02-27 18:12:34.874	2017-03-06 15:39:57.818	595642.944	172.24.48.118  172.23.152.62      *                       *
2017-02-27 18:12:38.872	2017-03-06 15:39:57.958	595639.086	172.23.152.62  172.17.24.50        *                       *
2017-02-27 18:12:24.939	2017-03-06 15:00:06.549	593261.610	172.23.152.62   172.24.48.118      500                  500 
2017-02-27 18:12:34.874	2017-03-06 15:39:57.818	595642.944	172.23.152.62   172.24.48.118      *                        *

That's an example of how I see why I do a query, just to keep in main all the IP addresses listed above are all WAN IP. None LAN traffic I see in the queries.


Thank you in advance

[tgriep]

Did someone edit the settings on the Juniper device to use the LAN port?
If not, they would have to edit the Juniper device and change the settings to the LAN port and then the NNA server will display the data that flows through the LAN port.

Try that and let us know the outcome.

The NNA server will display the data that is sent to it and setting up the correct interface in the Juniper in important to see the correct data that is flowing through the port.

[antorres]

Yesterday was the lucky day. I've seen line per line all the configuration in the Juniper, at a glance was everything perfect, then I`ve decided to remove the current configuration and start over new, i Followed step by step all the information i collected from diferent sources and it worked!!

So all the problem was on their side but nonetheless thank you so much for all your help. I really appreciate it

Best Regards.

[tgriep]

Your welcome. If you don't have anymore questions, shall I mark the post as solved and lock it up?

[antorres]

I think we're done with this thread, I will have more and more questions in the future for sure, but regarding this post, I think we are done.

Thank you one more time.