Create Application Metadata Intelligence Session for Virtual Environment

You can create an Application Metadata Intelligence session for virtual environment.

To create an Application Metadata Intelligence session, follow these steps:

1. Go to Traffic > Solutions > Application Intelligence.
2. From the Sessions pane, click and select Edit. The Edit Application Intelligence Session window appears.
3. In the Edit Application Intelligence Session window, click Application Metadata.

   Note:  If Application Filtering Intelligence License is available, you must create Application Filtering to create Application Metadata Intelligence. For more information, refer to Create Application Filtering Intelligence by Editing Monitoring Session from Dashboard

4. In the Destination Traffic section, click + Add New to create an exporter to receive application-specific traffic. You can also create multiple exporters.
   1. Enter the following details:

      Field	Description
      Tool Name	Enter the tool Name
      Tool IP Address	Enter the tool IP address
      Template	Select the tool template. Refer to Tool Templates for more details on what are tool templates and to create custom tool templates.
      L4 Source Port	Port from which the connection will be established to the target. For Example, if A is the source and B is the destination, this port value belongs to A.
      L4 Destination Port	Port to which the connection will be established from the source. For Example, if A is the source and B is the destination, this port value belongs to B.
      APPLICATION ID	Enable to export the data with Application Id.
      Format	Select NetFlow or CEF
      NetFlow: Select this option to use Netflow
      Record / Template type	● Segregated - The application-specific attributes and the generic attributes will be exported as individual records to the tool. ● Cohesive- The application-specific attributes and the generic attributes will be combined as a single record and exported to the tool.
      Active Timeout	Enter the active timeout value in seconds.
      Inactive Timeout	Enter the inactive timeout in seconds.
      Version	Select the NetFlow version.
      Template Refresh Interval	Enter the time interval at which the template must be refreshed in seconds
      CEF: Select this option to use CEF
      Record / Template type	● Segregated - The application-specific attributes and the generic attributes will be exported as individual records to the tool. ● Cohesive- The application-specific attributes and the generic attributes will be combined as a single record and exported to the tool.
      Active Timeout	Enter the active timeout value in seconds.
      Inactive Timeout	Enter the inactive timeout in seconds.

   2. Click App Editor, to select the applications and its attributes. You can select a maximum of 64 attributes for each of the application. (Not applicable when using NetFLow V5 Template in the above Template drop-down menu.) The Application Editor screen appears as shown:
   3. Select an Application Family and the Applications that needs to be filtered from the traffic. You can also select Add All Applications in Family or Delete All Applications in Family. The selected applications and their families appear in the Selected Applications section.

      Note:  You can select the required applications without selecting the application family.

5. In the Advanced Settings > Collects section, you can select the following packet attributes:
   • Counter - Select the Bytes, and Packets.
   • IPv4 - Select the required attributes. By default, Source Address, Destination Address, and Protocol are enabled.
   • IPv6 - Select the required attributes. By default, Source Address, Destination Address, and Next Header are enabled.
   • Transport -Select the required attributes. By default, Source Port, Destination Port are enabled.
   1. By default, the above collect types are displayed. Click to add the following collect types:
      • Data Link - Select any one of the parameters such as Source Mac, Destination Mac and VLAN.
      • Timestamp - Select the required timestamp such as System Uptime First, Flow Start, System Uptime Last, and Flow End.
      • Flow - Select the parameter as End Reason if required.
      • Interface - Select any one of the parameter such as Input Physical, Output Physical and Input Name.
6. In the Application Metadata Settings section:
   1. Select the Flow Behavior as any one of the following:
      • Uni-Directional
      • Bi-Directional. The default value is Bi-Directional.
   2. Enter the Timeout and Cache Size.
   3. You can enable or disable the Multi-Collect option to perform the following:
      • Enable — Enables the multi-collect of attributes within a given Metadata Store cache which means that if a configured attributes is seen in multiple packets within the same flow, each of these information is collected. By default, when a new cache is created, multi-collect is enabled. When upgraded from an older release, the multi-collect option is enabled.
      • Disable — Disables the multi-collect of attributes within a given Metadata Store cache.
   4. You can use the toggle button to enable or disable the Aggregate Mode, which is disabled by default. You need to delete the existing solution and recreate the solution to enable the Aggregate Mode. The Aggregate Mode option is applicable only for Gen 3 devices. Only one exporter is supported with the Aggregate Mode enabled.

      Protocol Name	Attribute
      http	rtt
      icmp	rtt
      icmp6	rtt
      ssh	rtt
      tcp	rtt
      tcp	rtt_app
      telnet	rtt
      wsp	connect_rtt
      wsp	query_rtt

      Note:  You need to enable the Aggregate Mode option to export the minimum, maximum, and mean of RTT values for the following list of supported protocols and attributes and also the aggregate of TCP Lost byte values collected per export time interval.

   5. You can enable or disable the Advance Hash option to perform the following:
      • Enable — Configures metadata cache advance-hash for encapsulated flows . This feature improves the efficiency of scheduling the distribution of encapsulated flows. It also improves the distribution of flows in service provider deployment cases. By default, when a new cache is created, advance hash is enabled. When upgraded from an older release, the advance hash is enabled.
      • Disable — Disables the metadata cache advance-hash for flows.
   6. If you want to include the VLAN ID along with the 5-tuple to identify the traffic flow, select the Data Link and enable the VLAN option.
   7. In the Observation Domain ID field, enter a value to identify the source from where the metadata is collected. The range is from 0 to 255. The calculated value of Observation Domain Id in Hexadecimal is 00 01 02 05, and in Decimal is 66053.
7. Click Save.

The metrics of the Application Metadata traffic appear on the dashboard.