H3C Technologies H3C Intelligent Management Center - Manual (Page 15)

5
NTA and network flow record processing overview
You must select the probes and devices for which you want to process data, and you must configure traffic
analysis tasks; otherwise, network flow records forwarded to NTA are ignored. There are several NTA
features that administrators use to configure if, what, and how network flow records are processed. These
features include NTA server management, traffic analysis task management, application and category
management, NTA filter strategies, and parameter settings. The following information provides an
overview of each of these features and describes how you use them to configure NTA to process network
flow records.
NTA server configuration
Using the features described in " Device management " and " Probe management ," you can configure
devices and probes to establish communication paths between NTA and the devices in your
infrastructure that you have enabled for network flow record generation. After you add a device or probe,
select the probes and devices for which you want to process data, as described in "
Modifying an NTA
server configuration ." Until you do this, devices and probes are not available as configuration options in
certain traffic analysis tasks such as interface and VPN traffic analysis tasks, and the data from devices
and probes are not included in any traffic analysis tasks.
Traffic analysis task management
Traffic analysis task management ties network flow records to data analysis, reporting, and report
navigation. Out of the box, NTA does not generate reports using the network flow records that are
directed to it through configurations on the devices and through the device and probe management
configurations in NTA. Administrators must create traffic analysis tasks that define how NTA reports all
network flow record data.
Traffic analysis tasks define how resources in a network are grouped for analysis and reporting purposes.
This has a direct impact on the utility and accessibility of the data presented in NTA reports. Traffic
analysis tasks also define how NTA presents report navigation and how you access reports. NTA creates
reports and makes them available on the left navigation tree under the Traffic Analysis and Audit area
based on task configuration.
NTA traffic analysis tasks govern whether network flow records are presented as reports in NTA. The next
step is to create traffic analysis tasks because traffic analysis tasks direct NTA to process and report on
the network flow records it receives. Traffic analysis tasks enable you to configure from which devices,
interfaces, and probes you process network flow records, as well as which NTA network flow collector
server processes the records. NTA supports the following types of network flow analysis tasks:
• Interface
• VLAN
• Probe
• Application
• Host
• VPN
• Inter-business traffic analysis
For interface, VLAN, probe, and VPN traffic analysis tasks, define from which interface, VLAN, probe, or
VPNs the task processes network flow records and reports. NTA processes all received network flow