So the interesting thing is I had opened a ticket to ask this same question and I got a totally opposite answer.:)
I guess the best thing to do here is after hours today test out the config and see how it goes. Else spin up another 3600 in the lab and give it a run through. Your answer makes a lot more sense to me but that’s me. I also appreciate the impact of sampling on the RE. That makes sense since the work isn’t punted to the PFE like in the case of the MX hardware. On Aug 21, 2014, at 1:53 PM, Tyler Christiansen <[email protected]<mailto:[email protected]>> wrote: No problem. Just keep in mind that with the RE processing flow data, you can quickly kill your RE if your sampling rate is too low. 1:1 sampling with the MX isn't as problematic since it's processed by the PFE. --tc On Thu, Aug 21, 2014 at 10:47 AM, Scott Granados <[email protected]<mailto:[email protected]>> wrote: This makes sense to me. Thanks for such a good response I really feel like I have a better bead on this now. Thanks Scott On Aug 21, 2014, at 1:43 PM, Tyler Christiansen <[email protected]<mailto:[email protected]>> wrote: This is platform-dependent. Some platforms (definitely EX, probably SRX) use the RE for processing flow data--so you can use fxp0. Other platforms (MX) use the PFE, which is why fxp0 is not a valid interface. I did some testing on this a few months ago to confirm that EX switches (at least 3200, 3300, 4200, 4500, and 4550) use RE and MX uses PFE. I think I tested our SRX550, too, and saw that it used RE. I honestly don't recall the results of the SRX test, though. You can find out pretty easily--if you enable it and you can see flow traffic using tcpdump on the SRX (or monitor traffic), it's handled by the RE. If you _don't_ see flow data (but you know it's actually being sent), it's handled by the PFE. --tc On Thu, Aug 21, 2014 at 10:09 AM, Scott Granados <[email protected]<mailto:[email protected]>> wrote: Hi, So I’m still a bit confused on what can or can’t be used in the flow monitoring processes. In this case I have an SRX 3600 with a routing instance. I found a config example that illustrates how to enable flow sampling in this type of environment. It specifically mentions that you use a source IP with in the global routing table and not the instance. In my case the only interface I have in the global instance is fxp0.0 (management). I have read in the case of the MX you can’t use the management interface asa flow source. I haven’t been able to find anything regarding the SRX. Is FXP0 a valid source for flow monitoring or do I need to create another interface, maybe a loopback, with in the global instance? Also, is there a good document that details better the limitations of flow monitoring on the SRX. I’ve found some bits and pieces but nothing centralized. Any pointers would be most appreciated. Thanks Scott _______________________________________________ juniper-nsp mailing list [email protected]<mailto:[email protected]> https://puck.nether.net/mailman/listinfo/juniper-nsp -- [https://adap.tv/sigs/logo.png] Tyler Christiansen | Technical Operations tyler<http://adap.tv/>@adap.tv<http://adap.tv/> | www.adap.tv<http://www.adap.tv/> m : 864.346.4095 -- [https://adap.tv/sigs/logo.png] Tyler Christiansen | Technical Operations tyler<http://adap.tv/>@adap.tv<http://adap.tv/> | www.adap.tv<http://www.adap.tv/> m : 864.346.4095 _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
