Overview

The FlowLink application normalizes and aggregates the network flow data that it collects from different types of network sources into a format that can be ingested by the PCE for use by traffic data applications. It does not resolve any flow data source and destination IP addresses in to the PCE workloads. The PCE displays the flow in Illumination and marks the policy decision as 'unknown'. FlowLink is supported on standard PCE clusters and also on Supercluster.

How FlowLink Works

FlowLink can receive the flow data by connecting to a data source provided by you and adheres to your organizations' data format. It may consume flows at a rate that is slower than the source speed. Therefore, the flow sender caches the flow data for 48 hours or more. If the PCE is unable to accept flow data because of the rate of flow or availability issues, FlowLink caches the data locally to a disk for a configurable period of time or disk space and retries periodically (user-configurable number of minutes). It aggregates data flows and sends them to the PCE once every configurable number of minutes. It does not have access to the PCE data and therefore no knowledge of workloads, virtual services, and other objects.

 

NOTE:

FlowLink version 1.1.0 does not support a High Availability (HA) configuration. You will have to monitor FlowLink and ensure that you restart it on failure.

Supported Flow Record Formats

The following types of flow records are supported:

  • AWS VPC flows
  • IPFIX v10
  • NetFlow v5, v7, v9, and v10
  • sFlow v5
  • Text (customizable parser configured by user, for example, Syslog or Kafka)