Quick Start Guide Quick Start Guide nMetrics

							Quick Start Guide
nMetrics Metascope Series

                  Created: July 2011
Information for this appliance and all other nMetrics products can be found on our website:
www.nmetrics.com.au under downloads for:

      Product Brochures
      Quick Start Guides

For further information, including that listed below, please contact nMetrics via the details below,
or apply for access to the nMetrics Partner Portal.

      Release Notes
      User manuals
      Reference and Configuration Documentation



For questions or more information, please email support@nmetrics.com.au
or phone directly +612 8338 1988.




                                          Quick Start Guide – Metascope Series
                                                         –2–
Please read these Legal Notices carefully.
By using an nMetrics Appliance you agree to the terms and conditions of usage set forth by nMetrics Pty Ltd.
No licenses, express or implied, are granted with respect to any technology described in this manual. nMetrics retains all
intellectual property rights associated with the technology described in this manual. This manual is intended to assist with
installing nMetrics products. nMetrics reserves the right to make changes in specifications and other information
contained in this document without prior notice. Every effort has been made to ensure that the information in this
document is accurate. nMetrics is not responsible for typographical errors.




                                              Quick Start Guide – Metascope Series
                                                             –3–
nMetrics Metascope Quick Start Guide
The following document provides a step by step guide to configure the nMetrics Metascope to monitor the
network. By following the steps outlined below a minimal configuration can be created to provide visibility of
major traffic flows.
For more information about configuring advanced features please refer to the nMetrics Metascope User Guide
or contact nMetrics Support at support@nmetrics.com.au



Assigning an IP Address to the Metascope
Each Metascope is shipped preconfigured with an IP address:

Default address of 192.168.1.10/24 configured on the management Ethernet port (The management port is labeled “Mgmt” and is
the second port from the right as shown below)




Connection to the Metascope may be established in 2 ways:

          Via Ethernet, directly connect the Metascope with a PC using the cross over Ethernet cable provided
           (the cable with the red ends). Ensure the PC is configured with an IP address in the 192.168.1.0/24
           subnet range and the cable is plugged into the management port on the Metascope.
           Connectivity can be tested by pinging the Metascope on 192.168.1.10 or establishing a web session
           directly to the unit.
          Via Serial, connect to the Metascope serial console port using the console cable provided. The
           console port is set for 9600 baud, 8 bits, no parity, one stop bit (9600,8,n,1).
           Once connected, the Metascope should present a login prompt, the default login is Username:
           system, password: system.

Once logged in, the management IP address settings may be changed from the Metascope command line
interface. Refer to user documentation for details.




                                              Quick Start Guide – Metascope Series
                                                             –4–
  Once connected to the Metascope via a web browser, the following login screen should display:




  The default user name and password for the administrative user is:
                                Username: system
                                Password: system



Setting the Management Interface Address
Once logged on select the Configure tab on the top menu and the Network Setup option on the side menu.
To alter the address of a management interface, from the main screen, select Modify for the Management port
and enter the relevant IP addressing information in the Interface Setup screen.




  Note that the Metascope needs to be rebooted for the new address to take effect.




Connecting the Metascope to the Network
The Metascope can be configured to collect network data in three different ways:
         1. Installation “inline”
            The Metascope provides a pair of ‘bypass’ ports that allow the device to be installed inline, The
            bypass ports, labelled Bypass1 and Bypass2, allow for network traffic to pass across the ports
            transparently. Additionally the bypass ports will also pass traffic should the Metascope lose
            power. The Metascope is usually installed inline between the switch and router.




                                              Quick Start Guide – Metascope Series
                                                             –5–
              Once the Metascope is physically connected inline, it must be configured to allow for collection
              on the bypass ports. To enable collection, go to the Configure->Network Setup screen and ensure
              that the ‘Bypass’ interface is set to Monitor mode. That is, make sure that the Monitor checkbox
              is ticked. To change this setting, select Modify for the Bypass interface.

           2. Connecting to configures switch SPAN or mirror port
              The Metascope provides two monitor ports labelled Monitor 1 and Monitor 2 to allow for data to
              be collected from a switch SPAN or mirror port (or in fact an Ethernet tap). If collecting from a
              switch SPAN/mirror port, simply connect the SPAN/mirror port to one of the Metascope
              Monitor ports directly.
              Once a SPAN/mirror port is physically connected to the Metascope Monitor port, it must be
              configured to allow for collection on this port. To enable collection, go to the Configure-
              >Network Setup screen and ensure that the relevant ‘Monitor’ interface is set to Monitor mode.
              That is, make sure that the Monitor checkbox is ticked. To change this setting, select Modify for
              the interface.

           3. Configured to collect data via Cisco NetFlow protocol
              Where the Metascope is configured to collect data from an external NetFlow agent, there are no
              additional port modifications or additional cabling required. NetFlow records are received on the
              Metascope management interface.
              The Metascope must be configured to allow NetFlow collection. Go to Configure->Global Config
              from the Collector Configuration settings, ensure that the appropriate NetFlow version is set
              along with the expected Port number. No further interface modifications are required to allow
              for NetFlow collection.

Testing the Data Collection Setup
The Metascope data collection configuration port can be easily tested using the Metascope packet capture
facility.
Start a new packet capture from the Packet Capture -> New Capture menu option. Select the appropriate
Metascope interface to start a new capture. For inline operation select the ‘Bypass’ interface, for SPAN/mirror
configuration select the appropriate ‘Monitor’ port, or for NetFlow configuration select the ‘Mgmt’ port,
Note that for NetFlow configurations, it is useful to specify a filter of the relevant UDP port for which NetFlow
has been configured, this allows for much easier troubleshooting.
Once started, the packet capture screen will refresh every 5 seconds. If the mirror port is configured correctly, a
large number of packets should be seen – that is, the captured packet counter should increase significantly
every time the screen refreshes.
Stop the capture (it will automatically stop at 1000 packets by default) and select the View Capture Statistics
button. A graphical display of the captured data will be displayed.
If the Metascope and/or mirror or SPAN ports are configured correctly, the traffic should show numerous
unicast connections between disparate IP addresses within the network. That is, numerous conversations
between different hosts.


                                           Quick Start Guide – Metascope Series
                                                          –6–
In the case of NetFlow configuration, you should see a number of UDP frames being captured.
If the capture shows only broadcast traffic or traffic to or from the address assigned to the Metascope, then it is
likely that the Metascope and/or switch mirror port is not configured correctly.



Starting the Capacity Planner Process
Once the switch mirror port is correctly configured and the attached Metascope interface set to Monitor, the
Capacity Planner process must be started. Note that this process may be configured to automatically start at
boot time, in which case it may be necessary to stop and restart the process. This is particularly important if the
Metascope monitor port configuration has been changed.
The Process Status screen (from Configure -> Process Status menu option) shows the current running state of all
Metascope processes.
                                      The main statistics collection process is the second on the list (Capacity
                                      Planner Remote Subnet Process). Check that this is running, or Stop and
                                      Restart if the port configuration has changed. This will ensure that the
                                      Metascope is collecting and analysing network traffic information.




Checking the Capacity Planner Process
Once the Capacity Planner Remote Subnet Process is running, the Metascope should be collecting and storing
data for all observed network flows. To confirm this, go to the Capacity Planner main screen.
If the Capacity Planner Remote Subnet process is running correctly, there
should be data for the Default subnet entry. If the main window shows all
zeros then:
         Wait 5 minutes for the Capacity Planner to update. New data is
          written on 5 minute boundaries (for example 12:05, 12:10,
          12:15 etc). Be sure to refresh the Capacity Planner main screen
          to be sure;
         Confirm that the Capacity Planner Remote Subnet process is
          running (from Configure -> Process Status)
        Confirm that the switch mirror port is correctly configured and the corresponding Metascope
         interface is set to Monitor mode.
Once data is showing for the Default subnet (that is, everything), then additional subnet entries may be added.




                                           Quick Start Guide – Metascope Series
                                                          –7–
Adding Capacity Planner Subnet Entries
Entries should be added for all subnets visible to the Metascope. This is typically all subnets relating to remote
sites that may communicate across the WAN, or other VLANs or subnets within the LAN environment.
At the very least, the subnet on which the Metascope itself resides should be added.
From the Capacity PlannerAdd Device side menu option select the Remote Subnet (Passive Monitoring) radio
button.
The Remote Subnet Details screen will be displayed with the relevant fields to define the Capacity Planner
subnet. The following fields need to be set:
      Remote Site Name; the name of the remote site.
      Remote Subnet Address; the remote subnet network address in dotted decimal notation ( e.g.
       192.168.1.0 ) .
      Remote Subnet Mask; the remote subnet mask in dotted decimal notation ( e.g. 255.255.255.0 ).
      Bandwidth to Site; the bandwidth available to this subnet expressed in bits per second. This value is
       used to calculate all percentage utilisation statistics for the subnet. In the context of a subnet, the
       Bandwidth to Site value should be set to the minimum bandwidth (or choke point) between the
       Metascope and the actual subnet. For example, if the subnet is connected via 2 hops, one being a 2 Mb
       E1 the other being a 64K ISDN, then this field should be set to 64 K.

Once all fields have been populated, select Next. The configured subnet should now appear in the list of
Remote Subnet devices in the Capacity Planner main screen.
Statistics for the newly configured subnet will be updated on the next database write on the 5 minute
boundary.


Other Metascope Functions
Once the Capacity Planner is configured, the Metascope may be configured to perform other tasks such as:
      Availability Management (checking device for up/down status);
      Event Management (triggering notification on usage threshold or device outages)
      Auto Reporting (generating and emailing regular reports on network usage)
      SNMP Statistics gathering (analysing performance of remote router interfaces)
      NetFlow Collection (gathering statistics using the Cisco NetFlow protocol)

For information on using or configuring these functions refer to the Metascope User Guide or contact nMetrics
Support on (02) 8338 1988 or at support@nmetrics.com.au.




                                          Quick Start Guide – Metascope Series
                                                         –8–