cisco - 路由器从两个不同的源 ID 导出 IPFIX 数据和模板

Question

我在路由器上配置 Netflow Flexible 使用 IPFIX 协议Cisco ASR 1001-X并成功接收到 IPFIX 数据包。路由器使用导出器（观察域 ID = 0）导出数据集，并使用另一个导出器（观察域 ID = 1）导出模板集。

我之前通过在 GNS3 上配置路由器进行了测试，但我从同一个导出器（观察域 ID）收到了数据集和模板集。

通过观察域 ID 和模板 ID 匹配数据和模板是否重要？或者我应该通过模板 ID 和源 IP 匹配数据和模板！

Answer 1

来自https://www.rfc-editor.org/rfc/rfc7011（ipfix rfc）：

观察域 ID（在消息头中）

  A 32-bit identifier of the Observation Domain that is locally
  unique to the Exporting Process.  The Exporting Process uses the
  Observation Domain ID to uniquely identify to the Collecting
  Process the Observation Domain that metered the Flows.  It is
  RECOMMENDED that this identifier also be unique per IPFIX Device.
  Collecting Processes SHOULD use the Transport Session and the
  Observation Domain ID field to separate different export streams
  originating from the same Exporter.  The Observation Domain ID
  SHOULD be 0 when no specific Observation Domain ID is relevant for
  the entire IPFIX Message, for example, when exporting the
  Exporting Process Statistics, or in the case of a hierarchy of
  Collectors when aggregated Data Records are exported.

模板 ID（在模板记录中）

  Each Template Record is given a unique Template ID in the range
  256 to 65535.  This uniqueness is local to the Transport Session
  and Observation Domain that generated the Template ID.  Since
  Template IDs are used as Set IDs in the Sets they describe, 
  values 0-255 are reserved for special Set types
  (e.g., Template Sets themselves), and Templates and Options
  Templates cannot share Template IDs within a
  Transport Session and Observation Domain.  There are no
  constraints regarding the order of the Template ID allocation.  As
  Exporting Processes are free to allocate Template IDs as they see
  fit, Collecting Processes MUST NOT assume incremental Template
  IDs, or anything about the contents of a Template based on its
  Template ID alone.

也就是说，“Observation Domain ID”（在您的情况下为源 id）和“模板 ID”唯一定义了相应的数据记录。因此，通过 source-id 和 template-id 匹配数据和模板非常重要。