Configuring switches to send sFlow to sFlowTrend

The sFlow agent running on a switch or router is responsible for sending sFlow data to sFlowTrend. The sFlow agent must be configured with three main parameters:

1. Receiver address and port:  The IP address and UDP port of the system that sFlowTrend is running on and on which it will receive data. By default sFlowTrend-Pro listens on all the system IP addresses using UDP port 6343. The configured receiver address must be reachable from the switch running the sFlow agent.
2. Sampling rate: The ratio of packets carried by an interface to the number of packets sampled. For example a sampling rate of 1024 specifies that, on average, 1 packet sample will be generated for every 1024 packets carried by an interface. The sampling rate configured should  generate enough samples to be statistically significant, but not too many samples such that the scalability of the system would be affected. Some suggested sampling rates for different traffic levels are given in the sFlowTrend help.
3. Polling interval: Controls how frequently counter data (for example interface counters) are exported. Configuring a counter polling interval of 30 seconds is recommended. This will cause counter data to be exported every 30 seconds on average. Since sFlowTrend accumulates data with one minute granularity, setting a counter polling interval of less than 20 seconds generates more load for the switch and the network without improving the resulting measurements.

In addition, some sFlow agent implementations allow the sFlow agent address to be configured. The sFlow agent address is included in the exported sFlow data and must uniquely identify the switch. sFlowTrend uses this address to attribute data to the different switches. Some sFlow agent implementations have an inappropriate default sFlow agent address of 0.0.0.0 or 127.0.0.1. This must be changed to a unique address for the switch, preferably an address that will respond to SNMP requests, in order for sFlowTrend to work properly. If the IP addresses for a switch are changed, then you should check that the sFlow agent address is updated properly; this sometimes requires a restart of the sFlow agent.

There are two methods for configuring the sFlow agent: SNMP and Command Line Interface (CLI).

sFlow configuration using SNMP

If a switch implements the sFlow MIB, sFlowTrend can use SNMP to configure the sFlow agent. In this case, you must ensure sFlowTrend is configured with the IP address of the switch and the correct SNMP credentials. The switch must also be configured to allow SNMP read and write from the sFlowTrend system. sFlowTrend will then make sure that the switch is configured with the correct settings for receiver address and port, sampling rate and polling interval for all interfaces.

Follow the steps in the section in the help Adding a switch configured by SNMP. The help also outlines steps for verifying and troubleshooting the configuration.

sFlow configuration using SNMP is accomplished as follows:

1. sFlowTrend uses SNMP to walk the ifTable to discover all interfaces and their ifSpeeds. This process also ensures that basic SNMP read access is working.
2. sFlowTrend then tests for the existence of the sFlow MIB.
3. On discovering the sFlow MIB, sFlowTrend then tries to claim a receiver entry by using SNMP SETs to write its configured receiver IP address and sFlow port, a unique string identifying this sFlowTrend instance, and a timeout value into the receiver entry. The receiver address and port used by sFlowTrend are configured in the System configuration, sFlow configuration dialog. A switch will support a fixed number of receiver entries, limiting the number of sFlow collectors that it can send data to. If all of the receiver entries have been claimed by other sFlow collectors, then sFlowTrend will fail to configure this switch and in the Configure agents dialog will report Already in use and list the other sFlow collectors. You can tell sFlowTrend to overwrite an existing receiver entry when there are no free entries by using the sflowtrend.useForce setting.
4. After having successfully claimed a receiver entry, sFlowTrend will then set sFlow MIB entries for each interface to configure the polling interval and the appropriate sampling rate. sFlowTrend chooses the sampling rate based on the ifSpeed of the interface discovered by walking the ifTable.
5. Periodically, sFlowTrend will refresh the timeout value in the receiver entry using an SNMP SET. This ensures that the switch will continue to send sFlow. However, if sFlowTrend is stopped, the timeout will decrease to zero and on reaching zero, the switch will clear the receiver entry and stop sending sFlow to sFlowTrend. This means that no resources are used in generating unwanted sFlow.

sFlow configuration using CLI

The sFlowTrend help gives some examples of CLI configuration of sFlow. Consult your switch documentation for further details. In this case, no configuration of sFlowTrend is required. Instead, as soon as sFlowTrend receives sFlow from a switch, the switch will be listed in the sFlowTrend System configuration, Configure agents dialog and the various switch selectors. If sFlowTrend does not list the switch, check the following:

1. The switch is configured with the correct receiver address and UDP port. You can verify the UDP port that sFlowTrend is listening on in the System configuration, sFlow configuration dialog.
2. There are no firewalls on the sFlowTrend system or the network that are blocking sFlow data.
3. The sFlowTrend system is reachable from the switch.
4. The sFlow agent on the switch is configured with a unique sFlow agent address.

 If you want sFlowTrend to display interfaces using ifName or ifAlias, or to display the sysName of the switch, you must configure sFlowTrend with SNMP read access to the switch.