Table Of Contents
Cisco Branch Routers Series Network Analysis Module
NM-NAM Operating Topologies and IP Address Assignments
Management Traffic—Choose One of the NM-NAM Interfaces
Monitored Traffic—Use One or Both of the NM-NAM Interfaces
NAM CLI Context-Sensitive Help
How to Configure and Manage the Cisco Branch Routers Series Network Analysis Module
Configuring the Analysis-Module Interface on the Router
Disabling AAA Login Authentication on the NAM Console Line
Opening and Closing a NAM Console Session from the Router
Configuring a Static Route to the NAM Through the Analysis-Module Interface
Enabling NAM Packet Monitoring
Enabling and Accessing the NAM Traffic Analyzer
Changing the NAM Root Password
Resetting the NAM Root Password to the Default Value
Opening and Closing a Telnet or SSH Session to the NAM
Types of NAM Software Upgrades
Upgrading the NAM Software—Patch
Upgrading the NAM Software—Full Image
Configuration Examples for the Network Analysis Module (NM-NAM)
NAM Management Interface Is Internal and Analysis-Module Interface Is IP Unnumbered: Example
NAM Management Interface Is External and Analysis-Module Interface Is IP Unnumbered: Example
Feature Information for Network Analysis Module
Cisco Branch Routers Series Network Analysis Module
Revised: May 23, 2006, Part Number OL-10702-01First Published: April 29, 2005Last Updated: June 28, 2006The Cisco Branch Routers Series Network Analysis Module (Cisco NM-NAM) feature is a network module that monitors and analyzes network traffic for Cisco 2600, Cisco 3660, and Cisco 3700 series routers using extended Remote Monitoring (RMON) standards, RMON2, and other Management Information Bases (MIBs).
Note
The Cisco Network Analysis Module (Cisco NAM) is available in multiple hardware forms for some Cisco routers and Catalyst switches. This document applies only to the NAM for branch routers, also known as modular access, multiservice, or integrated services routers.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all of the features documented in this module. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for Network Analysis Module" section.
Feature History for NM-NAM
Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
•
•
Prerequisites for NM-NAM
•
•
•
Restrictions for NM-NAM
General Restrictions
•
•
•
•
•
The following restrictions apply only to traffic that is monitored through the internal NAM interface:
•
•
•
•
–
–
•
–
–
–
Information About NM-NAM
NAM provides Layer 2 to Layer 7 visibility into network traffic for remote troubleshooting, real-time traffic analysis, application performance monitoring, capacity planning, and managing network-based services, including quality of service (QoS) and Voice over IP (VoIP). The NAM Traffic Analyzer is software that is embedded in the NM-NAM that gives you browser-based access to the RMON1, RMON2, DSMON, and voice monitoring features of the NAM.
To configure and manage the NM-NAM, you should understand the following concepts:
•
Note
NM-NAM
For informationabout specifications on hardware installation and cable connections, see the Cisco Network Modules Hardware Installation Guide.
Faceplate and LEDs
Figure 1 NM-NAM Faceplate and LEDs
NAM User Interfaces
The NAM has three user interfaces:
•
•
•
NAM Network Interfaces
The NAM uses three interfaces for communication (see Figure 2):
•
•
•
Note
Figure 2 NAM Network Interfaces
Analysis Module Interface
Use the Analysis-Module interface to access the NAM console for the initial configuration. After configuring the NAM IP parameters, use the Analysis-Module typically only during NAM software upgrades and while troubleshooting if the NAM Traffic Analyzer is inaccessible.
Visible only to the Cisco IOS software on the router, the Analysis-Module interface is an internal Fast Ethernet interface on the router that connects to the internal NAM interface. The Analysis-Module interface is connected to the router's Peripheral Component Interconnect (PCI) backplane, and performall configuration and management of the Analysis-Module interface from the Cisco IOS CLI.
External NAM Interface
Use the external NAM interface to monitor LAN traffic. You can also select the external NAM interface as the management interface for the NAM.
Visible only to the NAM software on the NM-NAM, the external NAM interface is the Fast Ethernet interface on the NM-NAM faceplate (see Figure 1). The external NAM interface supports data requests and data transfers from outside sources, and it provides direct connectivity to the LAN through an RJ-45 connector. You must perform all configuration and management of the external NAM interface from the NAM software.
Internal NAM Inteface
Use the internal NAM interface for monitoring traffic that passes through router interfaces. You can also select the internal NAM interface as the management interface for the NAM.
Visible only to the NAM software on the NM-NAM, the internal NAM interface is the Fast Ethernet interface on the NM-NAM that connects to the Analysis-Module interface on the router. The internal NAM interface is connected to the PCI bus on the NM-NAM, and you must perform all configuration and management of the internal NAM interface from the NAM software.
NM-NAM Operating Topologies and IP Address Assignments
This section includes the following topics:
•
•
Management Traffic—Choose One of the NM-NAM Interfaces
Select either the internal or external NAM interface to handle management traffic such as IP, HTTP, SNMP, Telnet, and SSH. You cannot send management traffic through both NAM interfaces at the same time.
How you assign IP addresses on the NAM network interfaces depends on which NAM interface, internal or external, you use for management traffic. See the following sections:
•
•
External NAM Interface for Management Traffic—How to Assign IP Addresses
If you select the external NAM interface to handle management traffic:
•
•
Internal NAM Interface for Management Traffic—How to Assign IP Addresses
If you select the internal NAM interface to handle management traffic:
•
•
Monitored Traffic—Use One or Both of the NM-NAM Interfaces
You can use either or both the internal and external NAM interfaces for monitoring traffic:
•
•
The same interface can be used for both management traffic and monitored traffic simultaneously.
Internal NAM Interface—Monitor LAN and WAN Traffic
When you monitor traffic through the internal NAM interface, you must enable NAM packet monitoring on each router interface that you want to monitor. NAM packet monitoring uses Cisco Express Forwarding to send a copy of each packet that is received from or sent out of the router interface to the NAM.
Monitoring traffic through the internal NAM interface enables the NAM to see any encrypted traffic after it is decrypted by the router. We recommend using the internal NAM interface to monitor WAN interfaces.
Note
External NAM Interface—Monitor LAN Traffic
Monitoring traffic through the external NAM interface does not impact router resources. Therefore, we recommend that you use the external NAM interface to monitor LAN traffic.
To monitor ports on Ethernet switching cards or modules (NM-16ESW-x, NMD-36ESW-x, HWIC-4ESW, or HWIC-D-9ESW), configure a Switched Port Analyzer (SPAN) session whose destination is the Ethernet switch port that connects to the external NAM interface. For more information about configuring SPAN for these cards and modules, see the following documents:
•
•
Sample Operating Topologies
In each of the following topologies, the router's LAN interface is monitored through the external NAM interface, and the router's WAN interface is monitored through the internal NAM interface:
•
•
•
To see sample configurations for the following topologies, see the "Configuration Examples for the Network Analysis Module (NM-NAM)" section.
NAM Management Interface Is Internal and Analysis-Module Interface Is Assigned an IP Address
Figure 3 shows a sample topology, in which:
•
•
Figure 3 NAM Management Interface Is Internal and Analysis-Module Interface Is Assigned an IP Address: Sample Topology
NAM Management Interface Is Internal and Analysis-Module Interface Is IP Unnumbered
Figure 4 shows a sample topology, in which:
•
•
•
Figure 4 NAM Management Interface Is Internal and Analysis-Module Interface Is IP Unnumbered b6: Sample Topology
NAM Management Interface Is External and Analysis-Module Interface Is IP Unnumbered
Figure 5 shows a sample topology where:
•
•
•
•
Figure 5 NAM Management Interface Is External and Analysis-Module Interface Is IP Unnumbered: Sample Topology
NAM CLI
The NAM CLI prompt is root@nam-system-hostname#. For example, if the NAM system hostname is configured as "nam1," then the NAM CLI prompt appears as root@nam1#. If the NAM system hostname is not yet configured, the NAM CLI prompt is root@localhost#.
This section includes the following topics:
•
Common NAM CLI Commands
Table 2 briefly describes the common NAM CLI commands that are used for initial configuration and maintenance of the NM-NAM. For a complete description of all NAM CLI commands, see the Network Analysis Module Command Reference for your NAM software.
Note
NAM CLI Access
There are three ways to access the NAM CLI:
•
•
•
Until you properly configure the NAM IP parameters, the only way to access the NAM CLI is by opening a NAM console session from the router.
NAM CLI Context-Sensitive Help
Table 3 shows what you must enter to use the NAM CLI context-sensitive help.
How to Configure and Manage the Cisco Branch Routers Series Network Analysis Module
This section contains the following procedures:
•
•
•
•
•
•
•
•
•
•
•
Configuring the Analysis-Module Interface on the Router
Use this procedure to configure the Analysis-Module interface on the router. For general information on the Analysis-Module interface, see the "Analysis Module Interface" section.
For information on assigning the IP address of the Analysis-Module interface, see the "NM-NAM Operating Topologies and IP Address Assignments" section.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
or
ip address ip-address mask7.
8.
9.
or
show running-configDETAILED STEPS
Step 1
enable
Example:Router> enable
Enables privileged EXEC mode.
•
Step 2
configure terminal
Example:Router# configure terminal
Enters global configuration mode.
Step 3
interface type number
Example:Router(config)# interface loopback 0
(Optional) Configures an interface, and enters interface configuration mode.
•
•
Step 4
ip address ip-address mask
Example:Router(config-if)# ip address 10.20.30.40 255.255.255.0
(Optional) Sets an IP address and mask for the interface.
•
•
Step 5
interface analysis-module slot/0
Example:Router(config)# interface analysis-module 1/0
Configures the Analysis-Module interface.
•
Step 6
ip unnumbered interface number
or
ip address ip-address mask
Example:Router(config-if)# ip unnumbered loopback 0
Example:Router(config-if)# ip address 10.20.30.40 255.255.255.0
Configures the Analysis-Module interface as IP unnumbered and specifies the interface whose IP address is borrowed by the Analysis-Module interface.
or
Sets an IP address and mask on the Analysis-Module interface.
•
Step 7
no shutdown
Example:Router(config-if)# no shutdown
Activates the Analysis-Module interface.
Step 8
end
Example:Router(config-if)# end
Router#
Returns to privileged EXEC mode.
Step 9
show ip interface brief
or
show running-config
Example:Router# show ip interface brief
Example:Router# show running-config
Displays the IP addresses and summary status of the interfaces.
or
Displays the contents of the currently running configuration file.
•
•
Step 10
Copy run start
Saves the running configuration to the startup configuration to avoid losing your configuration at the next system reload or power cycle.
Examples
This section provides the following examples:
•
•
•
•
Configuring the Analysis-Module Interface—Routable Subnet: Example
In the following example, the Analysis-Module interface is configured with a routable IP address. The NM-NAM is installed in router slot 2.
!interface Analysis-Module 2/0ip address 209.165.200.230 255.255.255.224no shutdownConfiguring the Analysis-Module Interface—IP Unnumbered with Routable Subnet: Example
In the following example, the Analysis-Module interface is IP unnumbered and borrows the IP address of the Fast Ethernet interface. The IP address is from a routable subnet, and the NM-NAM is installed in router slot 1.
!interface FastEthernet 0/0ip address 209.165.202.129 255.255.255.224no shutdown!interface Analysis-Module 1/0ip unnumbered FastEthernet 0/0no shutdown!Configuring the Analysis-Module Interface—IP Unnumbered with Subnet That Is Not Routable: Example
In the following example, the Analysis-Module interface is IP unnumbered and borrows a loopback interface IP address that is not routable. The NM-NAM is installed in router slot 3.
!interface loopback 0ip address 10.20.30.40 255.255.255.0!interface Analysis-Module 3/0ip unnumbered loopback 0no shutdown!Sample Output for the show ip interface brief Command
Router# show ip interface briefInterface IP-Address OK? Method Status ProtocolFastEthernet0/0 172.20.105.213 YES NVRAM up upFastEthernet0/1 172.20.105.53 YES NVRAM up upAnalysis-Module2/0 10.1.1.1 YES manual up upRouter#What to Do Next
If you configured authentication, authorization, and accounting (AAA) on your router, then proceed to the "Disabling AAA Login Authentication on the NAM Console Line" section.
Otherwise, proceed to the "Opening and Closing a NAM Console Session from the Router" section.
Disabling AAA Login Authentication on the NAM Console Line
If you configured authentication, authorization, and accounting (AAA) on your router, then you may have to log in twice to open a NAM console session from the router: first with your AAA username and password, and second with the NAM login and password.
If you do not want to log in twice to open a NAM console session from the router, then disable AAA login authentication on the router's NAM console line by performing this procedure.
Note, however, that if your router contains both the NM-NAM and the NM-CIDS, the Cisco intrusion detection system network module, then AAA can be a useful tool for centrally controlling access to both network modules. For information about AAA, see the Cisco IOS Security Configuration Guide for your Cisco IOS release.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enables privileged EXEC mode.
•
Step 2
configure terminal
Example:Router# configure terminal
Enters global configuration mode.
Step 3
aaa authentication login list-name none
Example:Router(config)# aaa authentication login name none
Creates a local authentication list.
•
Step 4
line number
Example:Router(config)# line 33
Enters line configuration mode for the line to which you want to apply the authentication list.
•
number = (32 x slot) + 1 (for Cisco 3700 series)
number = ( (32 x slot) + 1) x 2 (for Cisco 2800 and Cisco 3800 series)
Step 5
login authentication list-name
Example:Router(config-line)# login authentication name
Applies the authentication list to the line.
•
Step 6
end
Example:Router(config-line)# end
Returns to privileged EXEC mode.
Step 7
show running-config
Example:Router# show running-config
Displays the contents of the currently running configuration file.
•
What to Do Next
Proceed to the "Opening and Closing a NAM Console Session from the Router" section.
Opening and Closing a NAM Console Session from the Router
This procedure opens and closes a NAM console session from the router.
SUMMARY STEPS
1.
2.
3.
or
If a username prompt appears, then log in with your AAA username and password.4.
5.
or
If you have not changed the password from the factory-set default, enter root as the root password.6.
7.
8.
9.
10.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enables privileged EXEC mode.
•
Step 2
service-module analysis-module slot/0 session
Example:Router# service-module analysis-module 1/0 session
Example:Router# service-module analysis-module 1/0 session clear[confirm][OK]Router# service-module analysis-module 1/0 session
Establishes a console session with the NAM.
•
Step 3
Press Enter.
or
If a username prompt appears, then log in with your AAA username and password.
Example:Trying 10.1.1.1, 2065 ... Open
<Press Return>
Cisco Network Analysis Module (NM-NAM)
nam1.company.com login:
Example:Trying 10.1.1.1, 2065... Open
User Access Verification
Username: myaaausername
Password: <myaaapassword>
Cisco Network Analysis Module (NM-NAM)
nam1.company.com login:
Activates the NAM console line.
or
Completes AAA login authentication and activates the NAM console line.
•
Step 4
At the login prompt, enter root.
Example:login: root
Accesses the root (read/write) level of the NAM.
Step 5
At the password prompt, enter your password.
or
If you have not changed the password from the factory-set default, enter root as the root password.
Example:Password: <root>
—
Step 6
Perform the tasks that you need to perform in the NAM CLI. When you want to end the NAM console session and return to the Cisco IOS CLI, complete Step 7 to Step 10.
For initial configuration tasks, see the "Configuring the NM-NAM" section.
For help using NAM CLI commands, see the "How to Configure and Manage the Cisco Branch Routers Series Network Analysis Module" section.
Step 7
exit
Example:root@localhost(sub-custom-filter-capture)# exit
root@localhost# exit
login:
Logs out of the NAM system or leaves a subcommand mode.
•
Step 8
Hold Ctrl-Shift and press 6. Release all keys, and then press x.
Example:login: <suspend keystroke>
Router#
Suspends and closes the Telnet session.
Step 9
disconnect
Example:Router# disconnect
Disconnects a line.
Step 10
Press Enter.
Example:Closing connection to 10.20.30.40 [confirm] <Enter>
Confirms that you want to disconnect the line.
Examples
This section provides the following examples:
Opening and Closing a NAM Console Session When AAA Authentication Is Not Configured or Is Disabled on the NAM Console Line: Example
In the following example, a NAM console session is opened and closed from the router. The NM-NAM is installed in router slot 2.
Router# service-module analysis-module 2/0 sessionTrying 10.1.1.1, 2065 ... OpenCisco Network Analysis Module (NM-NAM)nam1.company.com login: rootPassword: <password>Terminal type: vt100Cisco Network Analysis Module (NM-NAM) Console, 3.2Copyright (c) 1999-2003 by cisco Systems, Inc.WARNING! Default password has not been changed!root@nam1.company.com#root@nam1.company.com# exitCisco Network Analysis Module (NM-NAM)nam1.company.com login: <suspend keystroke>Router# disconnectClosing connection to 10.1.1.1 [confirm] <Enter>Deleting login sessionOpening and Closing a NAM Console Session When AAA Authentication Is Configured and Enabled on the NAM Console Line: Example
In the following example, a NAM console session is opened and closed from the router. The NM-NAM is installed in router slot 2.
Router# service-module analysis-module 2/0 sessionTrying 10.1.1.1, 2065 ... OpenUser Access VerificationUsername: myaaausernamePassword: <myaaapassword>Cisco Network Analysis Module (NM-NAM)nam1.company.com login: rootPassword: <nampassword>Terminal type: vt100Cisco Network Analysis Module (NM-NAM) Console, 3.2Copyright (c) 1999-2003 by cisco Systems, Inc.WARNING! Default password has not been changed!root@nam1.company.com#root@nam1.company.com# exitCisco Network Analysis Module (NM-NAM)nam1.company.com login: <suspend keystroke>Router# disconnectClosing connection to 10.1.1.1 [confirm] <Enter>Deleting login sessionTroubleshooting Tips
Make sure that the NAM console line is clear by entering the service-module analysis-module slot/0 session clear command in privileged EXEC mode.
What to Do Next
Proceed to the Configuring the NM-NAM section.
Configuring the NM-NAM
This section describes how to configure the NM-NAM to establish network connectivity and configure IP parameters. This task must be performed from the NAM CLI. For more advanced NAM configuration, use the NAM Traffic Analyzer (web GUI) or see the Network Analysis Module Command Reference for your NAM software release.
For information on assigning IP addresses, see the "NM-NAM Operating Topologies and IP Address Assignments" section.
Prerequisites
Before doing this procedure, access the NAM console by performing Step 1 to Step 5 in the "Opening and Closing a NAM Console Session from the Router" section.
SUMMARY STEPS
1.
2.
3.
4.
5.
or
exsession on ssh6.
7.
Guest
