Gigamon

Enable SSH

Settings > Global Settings > SSH

Enable Packet slicing With this configuration in place, Gigamon appliance provided us the IPv6 header so all key information to generate flow data were present while we can reduce by using it utilization on link connected to monitoring device. Or the other option would be to combine it with aggregation and then we could handle traffic from multiple lines with one interface.

gsop alias Gigaslicing slicing protocol ipv6 offset 4 port-list gsg1

Configure map to get slicing to required ports:

map alias Pacslic1
    type regular byRule
    roles replace admin to owner_roles
    comment "packet slicing"
    use gsop Gigaslicing
    rule add pass ipver 6
    to 1/1/x15
    from 1/1/x1

Create a record:

apps netflow record alias Netflow_v9
    description "Test of Netflow export"
    netflow-version netflow-v9
    collect add counter bytes long
    collect add ipv4 fragmentation offset
    collect add ipv4 protocol
    collect add ipv4 source address
    collect add ipv4 destination address
    collect add transport source-port
    collect add transport destination-port
    collect add transport tcp flags ack enable cwr enable ece enable fin enable psh enable rst enable syn enable urg
enable
    collect add timestamp sys-uptime first
    collect add timestamp sys-uptime last
    collect add counter packets long
    collect add datalink mac source
    collect add datalink mac destination
    collect add datalink vlan
    collect add interface output physical width 4
    collect add ipv4 tos
    collect add ipv4 version
    collect add ipv4 fragmentation id
    match add ipv4 protocol
    match add ipv4 source address
    match add ipv4 destination address
    match add transport source-port
    match add transport destination-port

Associate record with monitor and define timeouts:

apps netflow monitor alias Netflow
    description "test of netflow"
    cache timeout active 300
    cache timeout inactive 30
    cache timeout event transaction-end
    record add Netflow_v9

Define exporter:

apps netflow exporter alias export1
    destination ip4addr 192.168.47.80
    dscp 0
    netflow-version netflow
    transport udp 3002
    template-refresh-interval 600
    ttl 64

Configure network map to create a connection between the network and port tunnel (port tunnel can work as a destination for flow):

map alias Netflow
    type regular byRule
    roles replace admin to owner_roles
    comment "to flowmon"
    use gsop netflow
    rule add pass ipver 4
    to 1/1/x8
    from 1/1/x1