Calculation Methods

Hi,

We have 70 locations each with a Cisco 3800 configured with an average of 50 sub-interfaces.

I will be using NPM, NTA on all sub-interfaces and NCM. This will be house on a Web Server 1 and SQL Database on SQL Server 2 central in our Head Office.

I would like to know if there is a calculation method you guys use to determine how much traffic is coming into the central Web Server and SQL server running this apps base on number of sites/elements, site Internet bandwidth and how much will it utilise on the HUBs Internet link for SNMP/ICMP polling (not much traffic) as well as Netflow traffics coming into the 2x servers mentioned above. Its the netflow traffic that I'm more concerned about as I'm not sure how big netflow packets coming from 70 location with 50 sub-interface monitored.

We will be purchasing SLX license for NPM/NTA and DL100 for NCM.

Thanks

Peter

Find more posts tagged with

Accepted answers

All comments

mcbridea

Hi Peter,

The amount of NetFlow data depends on how many user flows per second per interface you will have. Keeping in mind that all interfaces are not equal WRT user flows, data rate to NTA and SQL is an unknowable quantity at this point. With 50 sub IFs on 70 sites you're looking at 3500 exporters. A couple of things I can recommend to help your implementation are

1) where possible, use the physical interface for flow data rather than each sub IF. While this will not segragate data per sub IF it will catch all the flows from the physical IF and show individual enpoint data etc.

2) apply the exporters at the sub IF level for subs that are critical or for another reason require a finer level of interrogation.

I'm not making these recommendations because of limitations of NTA, just that NetFlow as a technology can create a huge amount of data.

BR - Andy

pvaldes

Hi Andy,

Thanks for the reply.

1. For each 70 location, the 3800 have only 2 physical interfaces, Gig0/0 WAN and Gig0/1 LAN. LAN we create multiple sub-interfaces which is assign unique VLANs using encapsulation dot1Q VLAN ID.

On the Gig0/1 LAN physical interface is where I setup the following command:

Slide 2

ip route-cache flow

Followed by global commands to start netflow:
Slide 2

ip flow-export version <version_number>

ip flow-export source <interface>

ip flow-export destination <IP address of the RA System> port#

ip flow-cache timeout active 1

Slide 2

snmp-server ifindex persist

2. We will not be treating individual sub-interface critical to the rest. All is monitored the same per location.

For a whole 1 location, their Internet link average utilization is around 80% of the total bandwidth and we upgrade the link once we see congestions (using Solarwinds NPM very soon).

I guess we will have to monitor our Head Office Internet Link during deployment of Solarwinds.

Thanks again for your help.