Configuring Prerequisites for Switch Telemetry

This section lists the configuration for the best switch monitoring experience in HPE Aruba Networking Central. Perform this configuration in Classic Central. Some configurations require MultiEdit support.

Note:

This section is applicable only for AOS-CX switches.

The following table describes the impact of different switch configurations on HPE Aruba Networking Central monitoring pages.

Table 1: Switch Configuration impact on Monitoring

Switch Configuration

How is it used ?

CIPT (Client IP tracker)

 Shows the IP address in Unified Clients List (UCL).

DFP (Device Finger Printing)

 Shows the host name of clients in UCL. This is used extensively for wired client profiling.

Client Insights

 Alerts, health, and Insights use this telemetry to identify AAA/DHCP/DNS failures and latency-related information.

DHCP Snooping 

 Alerts, health, and Insights use this telemetry to identify DHCP failures and DHCP latency.

ARC, IPFIX and Traffic insights - Enable DPI telemetry

 Required for application, TLS, website and application permission visibility. Client insights tags can be created based on the DPI telemetry. 
ARC, IPFIX and Traffic insights - Enable DNS telemetry Required to identify DNS failure and latency. Insights use this telemetry.

 

To configure switch telemetry:

  1. Configure authentication and DHCP related client events on AOS-CX switches in one of following ways, depending on the type of group:

    Note:

    To view the DHCP server IP address in the Client Connectivity card, in the Connection Steps section which appears in the expanded view of the card, use the following command:

    switch(config)# dhcpv4-snooping static-attributes

    DHCP events are generated only if DHCP snooping is enabled. To enable DHCH snooping, use the following commands:

    VLAN Level Enablement

    switch(config)# vlan 805

    switch(config-vlan-805)# dhcpv4-snooping

    switch(config-vlan-805)# dhcpv6-snooping

    Global Level Enablement

    switch(config-vlan-805)# dhcpv4-snooping

    switch(config-vlan-805)# dhcpv6-snooping

    • UI Group—Enable Client Events on the switch by toggling the Authentication and DHCP Events toggle to the on position. For more information, see Aruba Central Online Help.

    • Template Group—Configure the following commands for DHCP, client insight, and port access related events.

      switch(config)# dhcpv4-snooping event-log client

      switch(config)# dhcpv6-snooping event-log client

      switch(config)# port-access event-log client

      switch(config)# client-insight enable

      switch(config)# client-insight event-log

      client-onboarding

  2. Enable the IP Client Tracker under the Telemetry section in the Switch System profile to view the client’s IP address on the Unified Client List (UCL) page in HPE Aruba Networking Central. For more information, see Switch System Profile.

    client track ip

    client track ip all-vlans

  3. Enable the Device Fingerprinting Profile under the Telemetry section in the Switch System profile to obtain the host name and enhance client insight profiling in HPE Aruba Networking Central. For more information, see Switch System Profile.

    client device-fingerprint profile dfp_default

    lldp

    cdp

    dhcp

    http user-agent

    client device-fingerprint apply-profile dfp_default

  4. Configure the interface.

    switch(config)# interface <PORT-NUMBER>

    switch(config-if)# no shutdown

    switch(config-if)# no routing

    switch(config-if)# vlan access <VLAN-ID>

    switch(config)# client device-fingerprint

    apply-profile <name>

Note:

When configuring a DHCP server in HPE Aruba Networking Central WebUI, it is mandatory to specify the Prefix Length parameter under the Edit Profile side panel. However, when configuring AOS-CX switches using APIs, the Prefix Length parameter is optional.

Configuring DNS Latency Telemetry

This section lists the prerequisite configurations to enable the DNS latency telemetry.

To configure the DNS Latency Telemetry, complete the following steps:

  1. To enable the V2 default profile mode for AOS-CX 6400 Switch Series, run the profile v2-default command followed by configuration save and reboot commands.

    switch(config)# profile v2-default
    Note:

    In AOS-CX 6400 Switch Series, Application Visibility is supported only on 6400V2 (R0X38C, R0X40C, R0X41C, R0X42C, R0X43C, R0X44C and R0X45C) line cards.

  2. To disable IP source-lockdown resource-extended, run the following command:

    switch(config)# no ip source-lockdown resource-extended

  3. To enable Application Visibility globally, run the following commands:

    switch(config)# app-recognition

    Switch(config-app-recognition)# enable

  4. Enable flow-tracking if the AOS-CX switch runs 10.13 or later versions.

    Flow-tracking obtains DNS latency telemetry. To enable flow-tracking, run the following commands:

    switch(config)# flow-tracking

    Switch(config-flow-tracking)# enable

  5. Enable Application Visibility per client port or per user-role.

    • To enable Application Visibility for port, run the following commands:

      switch(config)# interface <PORT-NUMBER>

      Switch(config-if)# app-recognition enable

    • To enable Application Visibility for user-role, run the following commands:

      switch(config)# port-access role guest

      switch(config-pa-role)# app-recognition enable

  6. To configure IPFIX, enable Enable Flow Telemetry for Central under the Telemetry section in the Port Profile configuration page. This field is enabled by default. When enabled, the switch activates flow telemetry on the interface, applies the required global flow telemetry configurations, and begins sending flow telemetry information to HPE Aruba Networking Central. For more information see, Port Profile for Switches.

    The following global flow telemetry configurations are pushed to the AOS-CX Switch:

    flow exporter sys_cx_exporter_local_default description Default Flow Exporter with internal destination used in telemetry config destination type traffic-insightth destination traffic-insight sys_cx_ti_instance_default template data timeout 60 flow record sys_cx_record_v6_default description Default IPv6 Flow Record used in telemetry config match ipv6 destination address match ipv6 protocol match ipv6 source address match ipv6 version match transport destination port match transport source port collect application name collect counter bytes collect counter packets collect application https url collect application tcp establishment-time collect timestamp absolute first collect timestamp absolute last flow record sys_cx_record_v4_default description Default IPv4 Flow Record used in telemetry config match ipv4 destination address match ipv4 protocol match ipv4 source address match ipv4 version match transport destination port match transport source port collect application name collect counter bytes collect counter packets collect application https url collect application tcp establishment-time collect timestamp absolute first collect timestamp absolute last flow monitor sys_cx_monitor_v4_default description Default IPv4 Flow Monitor used in telemetry config exporter sys_cx_exporter_local_default record sys_cx_record_v4_default flow monitor sys_cx_monitor_v6_default description Default IPv6 Flow Monitor used in telemetry config exporter sys_cx_exporter_local_default record sys_cx_record_v6_default

  7. To configure Traffic Insight, create and enable Traffic Insight instance and specify the flow source:

    switch(config)# traffic-insight TI-01 -->Creates a Traffic Insight instance

    switch(config-ti)# source ipfix -->Sets the source protocol to collect flow information

    switch(config-ti)# enable -->Enables Traffic Insight

  8. Create a monitor for DNS Latency Telemetry in the Traffic Insight profile.

    switch(config)# traffic-insight TI-01

    switch(config-ti)# monitor mnti3 type dns-average-latency