-
Bug
-
Resolution: Unresolved
-
Undefined
-
netobserv-1.10
-
None
-
False
-
-
None
-
None
-
None
-
None
-
NetObserv - Sprint 282
-
None
-
None
-
When configuring netobserv with the PacketTranslation agent feature, and an IPFIX exporter, the related "xlat" fields are missing from the IPFIX exported data.
The fields "XlatSrcAddr", "XlatDstAddr", "XlatSrcPort" and "XlatDstPort" are expected to be part of the IPFIX output.
Also, the EnterpriseID field is currently not configurable in FlowCollector, which can be a source of conflicts with other vendors. It should be configurable.
How to test:
- Install netobserv and deploy FlowCollector, with agent feature enabled: PacketTranslation
- Deploy an IPFIX collector, that can read the following custom elements: PEN 2, ID 7745 (xlat source /ipv4) and 7746 (xlat dest /ipv4) , e.g. using a standalone FLP as a collector: https://github.com/jotak/flowlogs-pipeline/blob/66297474031abc28df2eb82bda1dfe08695d9719/contrib/kubernetes/ipfix-collector-stdout.yaml
- Configure FlowCollector with an IPFIX exporter:
exporters: - ipfix: targetHost: flp-ipfix-stdout.netobserv.svc.cluster.local targetPort: 2055 transport: UDP enterpriseID: 2 type: IPFIX
- Check the logs of flp-ipfix-stdout
Expected results: some flows visible in logs should include xlat IPs, mapped to the custom fields, example:
map[AsPath:[] BgpCommunities:[] BgpNextHop:[] BiFlowDirection:0 Bytes:66 CustomBytes_1:[10 244 0 10] CustomBytes_2:[10 89 0 2] CustomBytes_3:[] CustomBytes_4:[] CustomBytes_5:[] CustomInteger_1:0 CustomInteger_2:0 CustomInteger_3:0 CustomInteger_4:0 CustomInteger_5:0 CustomList_1:[] DstAddr:10.96.0.1 DstAs:0 DstMac:d2:37:a9:74:1f:b9 DstNet:0 DstPort:443 DstVlan:0 EgressVrfId:0 Etype:2048 FlowDirection:0 ForwardingStatus:0 FragmentId:0 FragmentOffset:0 HasMpls:false IcmpCode:0 IcmpType:0 InIf:0 IngressVrfId:0 IpTos:0 IpTtl:0 Ipv6FlowLabel:0 MplsCount:0 MplsLabelIp:[] MplsLastLabel:0 MplsLastTtl:0 Mpls_1Label:0 Mpls_1Ttl:0 Mpls_2Label:0 Mpls_2Ttl:0 Mpls_3Label:0 Mpls_3Ttl:0 NextHop:[] NextHopAs:0 ObservationDomainId:1 ObservationPointId:0 OutIf:0 Packets:1 Proto:6 SamplerAddress:10.244.0.1 SamplingRate:0 SequenceNum:71 SrcAddr:10.244.0.10 SrcAs:0 SrcMac:82:43:7c:6f:ac:ce SrcNet:0 SrcPort:48186 SrcVlan:0 TcpFlags:16 TimeFlowEnd:1768473104 TimeFlowEndMs:1768473104737 TimeFlowStart:1768473104 TimeFlowStartMs:1768473104737 TimeReceived:1768473107 Type:IPFIX VlanId:0]
(Here: "CustomBytes_1:[10 244 0 10] CustomBytes_2:[10 89 0 2]")