Medianet Reference Guide - Cisco

Chapter 6
Medianet Management and Visibility Design Considerations
Network-Embedded Management Functionality
This example is not the only recommended model for enabling NetFlow within an enterprise medianet,
but is an example of a methodology for collecting NetFlow data to gain some useful insight regarding
video flows at various points within the network infrastructure. You can choose to selectively enable
NetFlow collection at one or more strategic aggregation points in the network, such as the distribution
layer within different modules of a campus, depending on the desired visibility for video flows. For
example, NetFlow statistics can be collected at the ingress interfaces of the distribution layer switch
pairs at each module within a campus. In other words, statistics can be collected for traffic flows exiting
the core and entering each campus module. Statistics gathered from this type of NetFlow deployment
can be used to determine the following video traffic flows:
• Aggregated flows outbound across the corporate WAN to all the branch locations
• Flows into each building within the campus
• Aggregated flows outbound toward the Internet
This model can be useful because many video flows emanate from a central point within a campus data
center or campus service module, and flow out to users within each campus building or each branch
location. For example, unicast or broadcast enterprise TV as well as video-on-demand (VoD) flows to
desktop devices often follow this flow pattern. Likewise, because of the nature of TelePresence video,
the majority of the video flows within a multipoint meeting are from a centralized Cisco TelePresence
Multipoint Switch, potentially located within a data center or campus service module, out to the
Cisco TelePresence System endpoints located within the campus buildings and branch locations.
Additional flow information can be gathered by implementing NetFlow bidirectionally at the distribution
layer of each module. Note that this can preferably be done by enabling NetFlow statistics collection in
an ingress direction on other interfaces. Although video broadcasts, VoD, and multipoint TelePresence
tend to follow a flow model where the majority of traffic emanates from a central point outward to the
endpoints, Cisco IP video surveillance follows the opposite model. The majority of traffic in a Cisco IP
video surveillance deployment flows from cameras deployed within the campus buildings back to the
Video Surveillance Operations Manager (VSOM) server potentially deployed within a data center or
campus service module. However, note that implementing NetFlow collection bidirectionally can result
in some duplication of flow information when multiple collection points exist within the network
infrastructure.
Additional flow information can also be gathered by implementing NetFlow at the branch router itself,
to gain insight into the flows into and out of individual branch locations, if that level of detail is needed.
Keep in mind, however, that the NetFlow data export uses some of the available branch bandwidth. Also,
NetFlow in Cisco IOS router platforms is performed in software, potentially resulting in somewhat
higher CPU utilization depending on the platform and the amount of flow statistics collected and
exported. The use of flow filters and/or sampling may be necessary to decrease both CPU utilization and
bandwidth usage because of NetFlow flow record exports. Even with the campus distribution switches,
it may be desirable to implement flow filters and/or sampling to decrease CPU and bandwidth usage.
Note that data sampling may distort statistics regarding how much traffic is flowing across a single point
in the network. However, the relative percentages of the flows can still be useful from a bandwidth
allocation perspective. An alternative strategy may be to SPAN the flow traffic from the Cisco Catalyst
switch to a separate device, such as the Cisco Service Control Engine (SCE), which can then perform
analysis of the flows and export records to a centralized NetFlow collector for monitoring and reporting.
NetFlow Collector Considerations
The aggregation capabilities of the NetFlow collector determine to a large extent the usefulness of the
NetFlow data from a medianet perspective. Most NetFlow collectors provide monitoring and historical
reporting of aggregate bit rates, byte counts, and packet counts of overall IP data. Typically, this can be
further divided into TCP, UDP, and other IP protocols, such as Internet Control Message Protocol
(ICMP). However, beyond this level of analysis, some NetFlow collectors simply report Real-Time
OL-22201-01
Medianet Reference Guide
6-7