VMware NSX IPFIX
Configuration
VMware NSX IPFIX
provides network monitoring data similar to that provided by physical devices
and gives administrators a clear view of virtual network conditions.
VMware NSX virtualizes the
network by allowing the network administrator the ability to decouple the
network from physical hardware. This functionality makes it easy to grow and
shrink the network as needed and making the network transparent to the
applications traversing it.
By using NSX IPFIX in a
virtualized network, the network administrators gain visibility into the
virtual overlay network. The VXLAN IPFIX reporting using Netflow is enabled on
the host uplink. It provides visibility on the VTEP that is encapsulating the
packet, and the details of the VM that generated the inter-host traffic on an
NSX Logical Switch (VXLAN).
The distributed firewall
implements stateful tracking of flows. As these tracked flows go through a set
of state changes, IPFIX can be used to export data about the status of that
flow.
The tracked alerts include flow creation, flow denial,
flow update, and flow teardown. The denied alerts are exported as syslogs.