Table of Contents (Start)

MPLS Flow Mapping

The MPLS Flow Mapping page enables you to upload your network's MPLS flow map files. MPLS flow map files map MPLS attributes to flow data so that MPLS data can appear in FlowFalcon reports. To allow reporting, network-specific MPLS network attributes such as, VPN 2nd Top Layer ID, PE Egress Address, Customer VRF, Source IP Address, and PE Ingress Address are required. Use any application to create two .csv files that map MPLS attributes to flow data. Then use this page to upload the map files into SevOne NMS. The .csv files must be encoded in UTF-8.

About this feature...

MPLS attribute mapping feature is designed to help you report on flow data exported from the MPLS network that is used by multiple tenants and, the flow data can be associated with different tenants. It enriches flow data that includes the standard MPLS fields with attributes like Customer VRF Name and PE Ingress IP to enhance reporting and help users derive better insights.

This feature is optional for reporting on MPLS flow data. The mapping tables are only required for the MPLS attribute mapping feature.

In scenarios where no MPLS attribute mapping is needed, no special configuration is required to support flexible NetFlow with MPLS fields. A custom flow view is needed to report on the MPLS flow data.

From Cluster Manager > Cluster Settings tab > FlowFalcon subtab > field Enable MPLS Attribute Mapping allows you to map v9 NetFlow template data from core "P" routers and provides flow data for Customer Client IP, Customer Client Subnet, Customer VRF, Customer Application IP, Customer Application Subnet, PE Ingress IP, and PE Egress IP. It maps tenant names to conversations exported in flow records from core "P" routers using information from the .csv files.

The two mapping .csv files can be prepared using VRF Name and PE Ingress IP mappings based on information from your network. This mapping information can be collected via SNMP from the PE devices and other methods.

In addition to the standard 5-tuple attributes, the following attributes present in the Netflow v9 template data are used to perform a lookup in the mapping tables contained in the .csv files.

"MPLS-Label2" or mplsLabelStackSection2 - Customer VRF Label ID
"TopLabelAddr" or mplsTopLabelIPv4Address - PE Egress IP Address
"SrcAddr" - Customer Source IP Address
"DstAddr" - Customer Destination IP Address

When field Enable MPLS Attribute Mapping is enabled, all received flows are enriched with the following fields.

Field	Description
Customer Client IP	Customer-specific IP address of connection origin.
Customer Client Subnet	Customer-specific IP subnet for connection origin.
Customer VRF	Name of Customer VRF.
Customer Application IP	Customer-specific IP address for connection target.
Customer Application Subnet	Customer-specific IP subnet for connection target.
PE Ingress IP	IP address of Ingress PE router.
PE Egress IP	IP address of Egress PE router.

On SevOne DNC appliances, two additional mapping tables are maintained to add the enriched fields as .csv files.

(VPN 2nd Top Label ID, PE Egress Address) mapped to Customer VRF.
(Customer VRF, Source IP Address) mapped to PE Ingress Address.

To access the MPLS Flow Mapping page from the navigation bar, click the Administration menu, select Flow Configuration, and then select MPLS Flow Mapping.

images/download/attachments/163973182/mplsflowmapping-version-1-modificationdate-1693243166984-api-v2.png

In SevOne NMS, there are three requirements to map MPLS attributes to flow data for FlowFalcon reports.

On the Cluster Manager > Cluster Settings tab, FlowFalcon subtab, select the Enable MPLS Attribute Mapping check box and enter the MPLS Attribute Mapping Refresh Interval.
On the MPLS Flow Mapping page, upload two MPLS mapping files.
On the FlowFalcon View Editor, create FlowFalcon views that include at least one of the following fields:
- 45050: Customer Client IP
- 45051: Customer Client Subnet
- 45052: Customer VRF Name
- 45053: Customer Application IP
- 45054: Customer Application Subnet
- 45055: PE Ingress IP
- 45056: PE Egress IP

Upload Map Files to DNC

The map files must be uploaded to a single SevOne Dedicated NetFlow Collector (DNC) that uses the file. Because each DNC may be responsible for different mappings, it is necessary to upload a mapping file to each DNC that performs mapping. In order to direct the mapping file to a DNC, first navigate to the IP of the DNC, then upload the file.

Upload Map Files in SevOne NMS

Perform the following steps to upload the two files that map MPLS attributes. The first map file maps VPN 2nd Top Label ID, PE Egress Address, Customer VRF. The second map file maps Customer VRF, Source IP Address, PE Ingress Address.

In the Mapping 1 section, click to display the File Upload pop-up.
Navigate the file structure to locate and select the file that maps the VPN 2nd Top Label ID, PE Egress Address, and the Customer VRF.
Click Open on the pop-up to save the file locally.
Click Upload to move the file to the correct location and to complete the upload of the first map file.
Click Download Mapping 1 File to display the content of the first map file in a .csv format.

When you click Download Mapping 1 File button, it downloads a default VRFMapping.csv file with the format this feature expects the data to be in.

The .csv file uses Field ID 47 (MPLS Top Protocol IP - mplsTopLabelIPv4Address) and Field ID 71 (MPLS Stack Entry 2 - mplsLabelStackSection2) to lookup the mapped VRF Name. Field IDs 47 and 71 make use of the mapping CSV table to report on PE Egress IP, PE Ingress IP, and VRF Name in the flow reports.
In the Mapping 2 section, click to display the File Upload pop-up.
Navigate the file structure to locate and select the file that maps the Customer VRF, Source IP Address, and PE Ingress Address.
Click Open on the pop-up to save the file locally.
Click Upload to move the file to the correct location and to complete the upload of the second map file.
Click Download Mapping 2 File to display the content of the second map file in a .csv format.

When you click Download Mapping 2 File button, it downloads a default PEMapping.csv file with the format this feature expects the data to be in.

The .csv file uses the VRF Name, and Field ID 8 (Source IP) or Field ID 27 (Source IPv6) to lookup the mapped PE Ingress IP and report on PE Egress IP, PE Ingress IP, and VRF Name in the reports using flow views that include these fields

The two mapping .csv files can be prepared by using VRF Name and PE Ingress IP mappings based on the information available from your network.
Modify .csv file(s)

To modify the .csv file(s), you must follow the steps below.
1. Click and/or button to download the VRF / PE .csv mapping file(s) respectively.
2. Edit the .csv file(s) you have downloaded.
3. Click to navigate to the .csv file you want to upload then, click button.
4. Based on value set in field MPLS Attribute Mapping Refresh Interval from Cluster Manager > Cluster Settings tab, FlowFalcon subtab, the updates made in .csv file(s) will be applied by the netflowd collector. Field MPLS Attribute Mapping Refresh Interval is only available when Enable MPLS Attribute Mapping check box is selected.