Application Intelligence Session

Required License: The Application Monitoring( Application Visualization) capability is included as part of any one of these licenses. Application Filtering Intelligence, and Application Metadata Intelligence.

Supported Devices: GigaVUE-HC1 Gen 2, GigaVUE-HC1 Gen 3, GigaVUE-HC3 Gen 2, GigaVUE-HC3 Gen 3, GigaVUE-HC1-Plus, GigaVUE-HCT.

Refer to Supported GigaSMART Operations for more details on the devices that support GigaSMART operations.

Application Visualization (formerly known as Application Monitoring) collects application statistics and sends this information to GigaVUE-FM, which acts as an application monitor. The monitoring reports are sent to GigaVUE-FM through destination port 2056. The application statistics are displayed as a set of monitoring reports, providing easy-to-read graphical representations of application usage data. This gives you better insight and control over how your network is utilized and which applications consume the most resources. To enable Application Monitoring, you need to create the necessary application intelligence sessions on the nodes managed by GigaVUE-FM.

Application Visualization uses various classification methods to identify applications. The application statistics exported to GigaVUE‑FM may take up to seven minutes to populate in the following dashboards:

- Top 10 Applications

- Total Traffic

- Total Applications

Users can view the statistics based on Bits, Packets, and Flows. Historical data can be accessed for up to seven days, and users can export the application visualization records using the IP interface. However, it's not recommended to use the IP interface, as disruptions to the data plane may prevent GigaVUE‑FM from collecting and displaying statistics.

Note:  Users may want to filter traffic upfront based on VLAN, subnet, and host IP address. Filtering traffic upfront can also reduce the load on the DPI engine. Application Intelligence supports configuring L2-L4-based rules to filter such traffic.

Create an Application Intelligence Session in Physical Environment

To create an Application Intelligence Session:

1.

On the left navigation pane, select Traffic > Solutions > Application Intelligence.

2.

Click Create New. The Create Application Intelligence Session page appears.

Note:   If the Create button is disabled, check whether a valid license for Application Metadata Intelligence or Application Filtering Intelligence is available.

3.

In the Basic Info section complete the following:

■

Enter the name and description (optional).

■

Select Physical in the Environment field.

■

Select the node from the list of nodes.

4.

In the Configurations section, view the following:

a.

The export interval is fixed at five minutes, at which the Application Intelligence session will generate the reports for application monitoring.

Note:  When you upgrade to 6.4, the prior configured export interval will be updated to five minutes.

Note:  The Monitoring option is enabled by default. To increase the session performance it is recommended to disable this option.

b.

Select a GigaSMART Group. You can also choose to create a new GigaSMART Group.

•

Provide a name in the Alias field.

•

Select a port or multiple ports from the Port List.

•

Click Save.

For more information about creating a new GigaSMART group, refer to the Configure a GigaSMART Group section.

c.

Select the required interface. By default, Management Interface is enabled. To export the data through IP interface, uncheck the Management Interface check box. You can view the IP Interface field only after you select a GigaSMART Group.

d.

Select an IP interface that is used to create a dedicated channel to communicate all application statistics to GigaVUE-FM. You can also choose to create a new IP interface. For more information, refer to the IP Interfaces section.

e.

Enable the Fast Mode option for performance (less CPU cycles and less memory utilization) improvement. When the Fast Mode is enabled, some or all of the attributes of the applications will be disabled. You can view the list of attributes/applications available in the fast mode by navigating to the app editor under AMI feature in theGigaVUE‑FM. If all the attributes of the application are disabled then the application itself is disabled. Refer Fast Mode for more information.

Note:  The Fast Mode feature is supported in GigaVUE HC Series Gen 3 GigaSMART and GigaVUE V Series modules. The Fast Mode option can be enabled or disabled only when creating a new application intelligence session.

5.

In the User Defined Applications section, select the template from the inventory where it was created.

6.

If you are unable to view the required port in the Port field, perform these steps:

o

Click Port Editor. Select the Type as Tool from the drop-down list for the required Port Id. Select OK.

The selected Port appears in the list.

o

Select the Type as:

o

IPv4 - to allow the traffic in IPv4 interface.

o

IPv6 - to allow the traffic in IPv6 interface.

o

Provide the IP Address, IP Mask, Gateway, and MTU. Provide the IP address corresponding to the IP interface selected.

o

Click Save.

7.

In the DestinationSettings, enter the destination IP address. The version of IP address in the Destination field should be same as the version of IP address defined in the IP-interface (applicable only when IP interface is selected). By default, the IP address of the GigaVUE-FM interface is displayed.

8.

In the Source Traffic section, select a source port that require application monitoring in the Source ports field. Source port can be a single port, multiple ports, and port groups.

Note:   Ports already used as source ports in the intent-based orchestrated solution will not be listed in the drop-down.

9.

Click Save. The session created is added in the list view.

10.

In the created session, click Edit to perform operations related to Application Filtering, De-duplication and Application Metadata.

11.

Configure the rules for filtering the required traffic in the L2-L4 Rules fields. To configure a rule:

a.

Click Select Conditions. Select the required parameters from the drop-down list.

b.

Select the value for the parameters from the drop-down.

c.

Select the required options:

•

Pass or Drop - Based on the parameter selected in the Conditions fields, the traffic that matches the conditions will either be passed or dropped.

•

Bidirectional - Allows the traffic in both directions of the flow.

Note:  Click “+” to create multiple rules for filtering the required traffic, and click “+ New Source Traffic” to create multiple sources with filtering options.

The total applications participating in the network traffic are displayed in the Application Intelligence Dashboard. For more information about the dashboard, refer to the View the Application Intelligence Dashboard.

If the session configuration is unsuccessful, troubleshoot the error notified (refer to View the Health Status of a Solution). Click the Reapply all pending solutions button in the dashboard to redeploy the configuration.

Note:  GigaVUE-FM takes few minutes to display the application statistics.

You can also filter the traffic based on the applications. For more information, see Application Filtering Intelligence.

Upgrading the Protocol Signature

You can upgrade the protocol signature by upgrading the image file on the GigaSMART card, and by uploading the GigaSMART card image to GigaVUE-FM from the Internal Server or External Server. To select the image, follow the steps:

• Internal Server—Upload the GigaSMART card image to GigaVUE-FM from the internal server and select the image that you need to upgrade from the selected GigaSMART card.
• External Server—Provide the location of the image in the external server that you need to upgrade from the GigaSMART card.

For more information on upgrading the image, refer to the following topics in the GigaVUE-OS Upgrade guide:

• Upgrade from an External Image Server
• Upgrade with GigaVUE‑FM as the Image Server

Disable Application Visibility in Application Intelligence Session

To disable Application Visibility, do the following:

1.

Edit the Application Intelligence Session.

2.

Disable the checkbox next to Monitoring Enabled.

3.

Select Save.

After disabling the monitoring session, the Application Intelligence dashboard does not receive the updates and a message " Monitoring has been disabled. Please enable monitoring to get latest data " is shown in red at the top of the dashboard.

 

Fast Mode

The DPI engine provides a performance optimization functionality called “fast mode”. In this mode the performance is increased by the use of light parsers for processing the HTTP and DNS traffic. This increases the performance of HTTP and DNS based protocols and reduces the memory utilization.

Limitations of Fast Mode

Note:   In the protobook, you can check if a specific application supports the fast mode or not, by navigating to the Attributes tab of the specific application. If the Basic DPI Support field is yes, then the application supports the fast mode option.

Application Intelligence can also be configured for virtual environment, refer to Application Intelligence for more detailed information.