{"id":86610,"date":"2020-06-27T19:42:32","date_gmt":"2020-06-27T17:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/nastraivaem-eksport-ipfix-na-vmware-vsphere-distributed-switch-vds-i-posleduyushhij-monitoring-trafika-v-solarwinds"},"modified":"2020-06-27T19:42:32","modified_gmt":"2020-06-27T17:42:32","slug":"nastraivaem-eksport-ipfix-na-vmware-vsphere-distributed-switch-vds-i-posleduyushhij-monitoring-trafika-v-solarwinds","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nastraivaem-eksport-ipfix-na-vmware-vsphere-distributed-switch-vds-i-posleduyushhij-monitoring-trafika-v-solarwinds","title":{"rendered":"Nastaven\u00ed exportu IPFIX na VMware vSphere Distributed Switch (VDS) a n\u00e1sledn\u00e9 monitorov\u00e1n\u00ed provozu v Solarwinds","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ahoj, Habr! Na za\u010d\u00e1tku \u010dervence Solarwinds ozn\u00e1mil uveden\u00ed nov\u00e9 verze platformy Orion Solarwinds<\/a><\/noindex> \u2014 2020.2. Jedn\u00edm z nov\u00fdch prvk\u016f v modulu Network Traffic Analyzer (NTA) je podpora rozpozn\u00e1v\u00e1n\u00ed IPFIX provozu od VMware VDS. <\/p>\n

\"Nastaven\u00ed
\n
\nAnal\u00fdza provozu v prost\u0159ed\u00ed virtu\u00e1ln\u00edho switche je d\u016fle\u017eit\u00e1 pro porozum\u011bn\u00ed distribuci z\u00e1t\u011b\u017ee na virtu\u00e1ln\u00ed infrastruktu\u0159e. Anal\u00fdzou provozu je tak\u00e9 mo\u017en\u00e9 odhalit migraci virtu\u00e1ln\u00edch stroj\u016f. V tomto \u010dl\u00e1nku se pod\u00edv\u00e1me na nastaven\u00ed exportu IPFIX na stran\u011b virtu\u00e1ln\u00edho switche VMware a na mo\u017enosti Solarwinds s n\u00edm pracovat. Na konci \u010dl\u00e1nku najdete odkaz na online demo Solarwinds (p\u0159\u00edstup bez registrace a nejde o fr\u00e1zi). Podrobnosti n\u00ed\u017ee.
\n<\/a><\/noindex>
\nPro spr\u00e1vn\u00e9 rozpozn\u00e1n\u00ed provozu z VDS je nejprve nutn\u00e9 nastavit p\u0159ipojen\u00ed p\u0159es rozhran\u00ed vCenter, a pot\u00e9 analyzovat provoz a zobrazovat body v\u00fdm\u011bny provozu poch\u00e1zej\u00edc\u00edho od hypervizor\u016f. Pokud m\u00e1te z\u00e1jem, m\u016f\u017ee b\u00fdt switch nakonfigurov\u00e1n tak, aby p\u0159ij\u00edmal v\u0161echny z\u00e1znamy IPFIX z jedn\u00e9 IP adresy p\u0159idru\u017een\u00e9 k VDS, ale v\u011bt\u0161inou je informativn\u011bj\u0161\u00ed vid\u011bt data extrahovan\u00e1 z provozu z\u00edskan\u00e9ho od ka\u017ed\u00e9ho hypervizoru. Provoz, kter\u00fd p\u0159ich\u00e1z\u00ed, bude p\u0159edstavovat spojen\u00ed od nebo k virtu\u00e1ln\u00edm stroj\u016fm um\u00edst\u011bn\u00fdm na hypervizorech.<\/p>\n

Dal\u0161\u00ed dostupnou variantou konfigurace je export pouze intern\u00edch tok\u016f dat. Tato mo\u017enost vylu\u010duje toky, kter\u00e9 jsou zpracov\u00e1v\u00e1ny na extern\u00edm fyzick\u00e9m switchi, a zabra\u0148uje duplicitn\u00edmu z\u00e1znamu provozu pro spojen\u00ed od a k VDS. Ale u\u017eite\u010dn\u011bj\u0161\u00ed je tuto mo\u017enost vypnout a sledovat v\u0161echny toky, kter\u00e9 jsou viditeln\u00e9 ve VDS.<\/p>\n

Nastaven\u00ed toku z VDS<\/h1>\n

\nZa\u010dn\u011bme p\u0159id\u00e1n\u00edm instance vCenter do Solarwinds. Pot\u00e9 bude NTA m\u00edt informace o konfiguraci platformy virtualizace.<\/p>\n

P\u0159ejd\u011bte do nab\u00eddky \u00abManage Nodes\u00bb, pot\u00e9 \u00abSettings\u00bb a vyberte \u00abAdd Node\u00bb. N\u00e1sledn\u011b je t\u0159eba zadat IP adresu nebo pln\u00e9 dom\u00e9nov\u00e9 jm\u00e9no instance vCenter a vybrat \u00abVMware, Hyper-V, or Nutanix entities\u00bb jako metodu dotazu.<\/p>\n

\"Nastaven\u00ed
\n
\nP\u0159ejd\u011bte do dialogov\u00e9ho okna pro p\u0159id\u00e1n\u00ed uzlu, p\u0159idejte p\u0159ihla\u0161ovac\u00ed \u00fadaje instance vCenter a otestujte je pro dokon\u010den\u00ed nastaven\u00ed.<\/p>\n

\"Nastaven\u00ed
\n
\nPo n\u011bjak\u00e9 dob\u011b prob\u00edh\u00e1 po\u010d\u00e1te\u010dn\u00ed dotazov\u00e1n\u00ed instance vCenter, obvykle 10-20 minut. Je t\u0159eba po\u010dkat na jeho dokon\u010den\u00ed, a potom povolit export IPFIX na VDS.<\/p>\n

Po nastaven\u00ed monitorov\u00e1n\u00ed vCenter a z\u00edsk\u00e1n\u00ed invent\u00e1rn\u00edch dat o konfiguraci virtualiza\u010dn\u00ed platformy zapneme na p\u0159ep\u00edna\u010di export z\u00e1znam\u016f IPFIX. Nejrychlej\u0161\u00ed zp\u016fsob, jak to ud\u011blat, je p\u0159es klienta vSphere. P\u0159ejd\u011bme na kartu \u201eNetworking\u201c, vyberme VDS a na kart\u011b \u201eConfigure\u201c najdeme aktu\u00e1ln\u00ed nastaven\u00ed pro NetFlow. VMware pou\u017e\u00edv\u00e1 term\u00edn \u201eNetFlow\u201c k ozna\u010den\u00ed exportu proudu, ale skute\u010dn\u00fd protokol, kter\u00fd se pou\u017e\u00edv\u00e1, je IPFIX.<\/p>\n

\"Nastaven\u00ed
\n
\nChcete-li zapnout export proudu, vyberte \u201eSettings\u201c v nab\u00eddce \u201eActions\u201c naho\u0159e a p\u0159ejd\u011bte k \u201eEdit NetFlow\u201c.<\/p>\n

\"Nastaven\u00ed
\n
\nV tomto dialogov\u00e9m okn\u011b zadejte IP adresu sb\u011bra\u010de, kter\u00fd je z\u00e1rove\u0148 instanc\u00ed Orion. Obvykle se pou\u017e\u00edv\u00e1 port 2055. Doporu\u010dujeme ponechat pole \u201eSwitch IP Address\u201c pr\u00e1zdn\u00e9, co\u017e povede k z\u00edsk\u00e1n\u00ed z\u00e1znam\u016f o proudech p\u0159\u00edmo z hypervizor\u016f. To poskytne flexibilitu p\u0159i dal\u0161\u00edm filtrov\u00e1n\u00ed proudu dat z hypervizor\u016f.<\/p>\n

Ponechte pole \u201eProcess internal flows only\u201c vypnut\u00e9, co\u017e umo\u017en\u00ed vid\u011bt v\u0161echny komunikace: jak intern\u00ed, tak extern\u00ed.<\/p>\n

Jakmile zapnete export proudu pro VDS, je tak\u00e9 nutn\u00e9 zapnout ho pro distribuovan\u00e9 portov\u00e9 skupiny, ze kter\u00fdch chcete z\u00edsk\u00e1vat data. Nejjednodu\u0161\u0161\u00ed zp\u016fsob, jak to ud\u011blat, je kliknout prav\u00fdm tla\u010d\u00edtkem my\u0161i na naviga\u010dn\u00ed panel VDS a vybrat \u201eDistributed Port Group\u201c, a pot\u00e9 \u201eManage Distributed Port Groups\u201c.<\/p>\n

\"Nastaven\u00ed
\n
\n\"Nastaven\u00ed
\n
\nOtev\u0159e se dialogov\u00e9 okno, ve kter\u00e9m je t\u0159eba za\u0161krtnout pol\u00ed\u010dko \u201eMonitoring\u201c a stisknout \u201eNext\u201c.<\/p>\n

Na dal\u0161\u00edm kroku m\u016f\u017eete vybrat ur\u010dit\u00e9 nebo v\u0161echny skupiny port\u016f.<\/p>\n

\"Nastaven\u00ed
\n
\nNa dal\u0161\u00edm kroku p\u0159epn\u011bte NetFlow na \u201eEnabled\u201c.<\/p>\n

\"Nastaven\u00ed
\n
\nKdy\u017e je export proudu na VDS a distribuovan\u00fdch portov\u00fdch skupin\u00e1ch povolen, uvid\u00edte, jak za\u010d\u00ednaj\u00ed p\u0159ich\u00e1zet z\u00e1znamy proudu pro hypervizory do instance NTA.<\/p>\n

\"Nastaven\u00ed
\n
\nHypervizory lze vid\u011bt v seznamu zdroj\u016f dat proudu na str\u00e1nce \u201eManage Flow Sources\u201c v NTA. P\u0159epn\u011bte na \u201eNodes\u201c.<\/p>\n

\"Nastaven\u00ed
\n
\nV\u00fdsledky nastaven\u00ed m\u016f\u017eete vid\u011bt na demo st\u00e1nku<\/a><\/noindex>. V\u0161imn\u011bte si mo\u017enosti p\u0159ej\u00edt na \u00farove\u0148 uzlu, protokolu interakce atd. <\/p>\n

\"Nastaven\u00ed
\n
\nIntegrace s dal\u0161\u00edmi moduly Solarwinds v jednom rozhran\u00ed umo\u017e\u0148uje prov\u00e1d\u011bt vy\u0161et\u0159ov\u00e1n\u00ed v r\u016fzn\u00fdch rozm\u011brech: pod\u00edvat se, kte\u0159\u00ed u\u017eivatel\u00e9 se p\u0159ihla\u0161ovali na virtu\u00e1ln\u00ed stroj, v\u00fdkon serveru (pod\u00edvejte se na demo)<\/a><\/noindex>, a aplikac\u00ed na n\u011bm, pod\u00edvat se na souvisej\u00edc\u00ed s\u00ed\u0165ov\u00e1 za\u0159\u00edzen\u00ed a mnoho dal\u0161\u00edho. Nap\u0159\u00edklad pokud ve va\u0161\u00ed s\u00ed\u0165ov\u00e9 infrastruktu\u0159e pou\u017e\u00edv\u00e1te protokol NBAR2, Solarwinds NTA dok\u00e1\u017ee \u00fasp\u011b\u0161n\u011b rozpoznat provoz z Zoom<\/a><\/noindex>, Teams<\/a><\/noindex> nebo Webex<\/a><\/noindex>.<\/p>\n

Hlavn\u00edm c\u00edlem tohoto \u010dl\u00e1nku je uk\u00e1zat jednoduchost nastaven\u00ed monitorov\u00e1n\u00ed v Solarwinds a \u00faplnost shroma\u017e\u010fovan\u00fdch dat. V Solarwinds m\u00e1te \u0161anci vid\u011bt celkov\u00fd obraz toho, co se d\u011bje. Pokud chcete prezentaci \u0159e\u0161en\u00ed nebo si to v\u0161echno vyzkou\u0161et \u2014 zanechte \u017e\u00e1dost na kontaktn\u00edm formul\u00e1\u0159i<\/a><\/noindex> nebo n\u00e1m zavolejte.<\/p>\n

Na Habru m\u00e1me tak\u00e9 \u010dl\u00e1nek o bezplatn\u00fdch \u0159e\u0161en\u00edch Solarwinds<\/a><\/noindex>.<\/p>\n

P\u0159ihlaste se k na\u0161emu skupin\u011b na Facebooku<\/a><\/noindex>.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u0438\u044e\u043b\u044f Solarwinds \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043b \u0440\u0435\u043b\u0438\u0437 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Orion Solarwinds \u2014 2020.2. \u041e\u0434\u043d\u043e \u0438\u0437 \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 Network Traffic Analyzer (NTA) \u2014 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0432\u0430\u043d\u0438\u044f IPFIX-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 VMware VDS. \u0410\u043d\u0430\u043b\u0438\u0437 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u0441\u0440\u0435\u0434\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430 \u0432\u0430\u0436\u0435\u043d \u0434\u043b\u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443. \u0410\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044f \u0442\u0440\u0430\u0444\u0438\u043a, \u043c\u043e\u0436\u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u044e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u0412 \u044d\u0442\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86611,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86610","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nastavujeme export IPFIX na VMware vSphere Distributed Switch (VDS) a n\u00e1sledn\u00e9 monitorov\u00e1n\u00ed provozu v Solarwinds | ProHoster","description":"Ahoj, Habr!","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nastraivaem-eksport-ipfix-na-vmware-vsphere-distributed-switch-vds-i-posleduyushhij-monitoring-trafika-v-solarwinds","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u044d\u043a\u0441\u043f\u043e\u0440\u0442 IPFIX \u043d\u0430 VMware vSphere Distributed Switch (VDS) \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 Solarwinds | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440!","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nastraivaem-eksport-ipfix-na-vmware-vsphere-distributed-switch-vds-i-posleduyushhij-monitoring-trafika-v-solarwinds","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-27T17:42:32+00:00","article:modified_time":"2020-06-27T17:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86610","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:12:22","updated":"2022-09-30 12:49:44","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/86610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=86610"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/86610\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/86611"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=86610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=86610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=86610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}