We’ve just released Noction Flow Analyzer (NFA) v24.11, and here are the new features...
![NFA v24.11 is here: API Keys, SNMP Percentile Representation, Interval Picker and more.](https://www.noction.com/wp-content/uploads/2024/10/NFA-24-11.png)
Request a personalized demo/review session of our Intelligent Routing Platform
Evaluate Noction IRP, and see how it meets your network optimization challenges
Schedule a one-on-one demonstration of our network traffic analysis product
Test drive NFA today with your own fully featured 30-day free trial
Discover the latest Noction product and company news
The latest networking industry trends, opinion, and perspectives
Learn about who we are, our mission, and our values
Read our press releases to get the latest information on Noction
See the new job openings, our values and the corporate culture
Need help? Contact the Noction support team
We’ve just released Noction Flow Analyzer (NFA) v24.11, and here are the new features...
Get a custom IRP quote as per your network traffic 95th percentile
Simple, transparent and easy-to-understand pricing structure
Discover IRP features, review use cases and make informed decisions
Watch Noction IRP videos, screencasts and client testimonials
Technical Noction IRP documentation, deployment instructions and datasheets
Get a first-hand network performance view of the major Tier 1 Carriers
See answers to the questions we get asked the most about Noction IRP
Product overview, user guide and the deployment instructions documents
Practical and useful info on NFA and the overall NetFlow analysis
A series of the most common NFA questions and answers
24/7 network monitoring, maintenance, and event management services
Free custom-built Transit Providers performance evaluation reports
The free-of-charge live Tier 1 providers' performance monitoring service
Review network performance indicators of the top US-based carriers for the past month.
BGP routing optimization platform for utmost network performance
Free feature-restricted Intelligent Routing Platform version
Network traffic analysis, monitoring and alerting system
Listing 2.56: Generate keys on $IRPMASTER
root@IRPMASTER ~ # ssh-keygen -t rsa -b 2048 -f ~/.ssh/id_rsa -C "failover@noction"
Listing 2.57: Install public key on $IRPSLAVE
root@IRPMASTER ~ # cat ~/.ssh/id_rsa.pub | while read key; do ssh $IRPSLAVE "echo $key >> ~/.ssh/authorized_keys"; done
Listing 2.58: Check SSH certificate-based authentication works
root@IRPMASTER ~ # ssh $IRPSLAVE
Listing 2.59: Generate CA and certificates
# cd && rm -rvf irp-certs && mkdir -p irp-certs && cd irp-certs # openssl genrsa 2048 > $(hostname -s)-ca-key.pem # openssl req -new -x509 -nodes -days 3600 -subj "/C=US/ST=CA/L=Palo Alto/O=Noction/OU=Intelligent Routing Platform/CN=$(/bin/hostname) CA/emailAddress=support@noction.com" -key $(hostname -s)-ca-key.pem -out $(hostname -s)-ca-cert.pem # openssl req -newkey rsa:2048 -days 3600 -subj "/C=US/ST=CA/L=Palo Alto/O=Noction/OU=Intelligent Routing Platform/CN=$(/bin/hostname) server/emailAddress=support@noction.com" -nodes -keyout $(hostname -s)-server-key.pem -out $(hostname -s)-server-req.pem # openssl rsa -in $(hostname -s)-server-key.pem -out $(hostname -s)-server-key.pem # openssl x509 -req -in $(hostname -s)-server-req.pem -days 3600 -CA $(hostname -s)-ca-cert.pem -CAkey $(hostname -s)-ca-key.pem -set_serial 01 -out $(hostname -s)-server-cert.pem # openssl req -newkey rsa:2048 -days 3600 -subj "/C=US/ST=CA/L=Palo Alto/O=Noction/OU=Intelligent Routing Platform/CN=$(/bin/hostname) client/emailAddress=support@noction.com" -nodes -keyout $(hostname -s)-client-key.pem -out $(hostname -s)-client-req.pem # openssl rsa -in $(hostname -s)-client-key.pem -out $(hostname -s)-client-key.pem # openssl x509 -req -in $(hostname -s)-client-req.pem -days 3600 -CA $(hostname -s)-ca-cert.pem -CAkey $(hostname -s)-ca-key.pem -set_serial 01 -out $(hostname -s)-client-cert.pem
Verify certificates. Commands must be run on both $IRPMASTER and $IRPSLAVE nodes:
Listing 2.60: Verify certificates
# openssl verify -CAfile $(hostname -s)-ca-cert.pem $(hostname -s)-server-cert.pem $(hostname -s)-client-cert.pem server-cert.pem: OK client-cert.pem: OK
Install certificates in designated directories. Commands must be run on both $IRPMASTER and $IRPSLAVE nodes:Cross copy client key and certificates:
Listing 2.61: Install certificates in designated directories
# mkdir -p /etc/pki/tls/certs/mysql/server/ /etc/pki/tls/certs/mysql/client/ /etc/pki/tls/private/mysql/server/ /etc/pki/tls/private/mysql/client/ # cp $(hostname -s)-ca-cert.pem $(hostname -s)-server-cert.pem /etc/pki/tls/certs/mysql/server/ # cp $(hostname -s)-ca-key.pem $(hostname -s)-server-key.pem /etc/pki/tls/private/mysql/server/ # cp $(hostname -s)-client-cert.pem /etc/pki/tls/certs/mysql/client/ # cp $(hostname -s)-client-key.pem /etc/pki/tls/private/mysql/client/ # cd && rm -rvf irp-certs
Listing 2.62: Cross copy client key and certificates
root@IRPMASTER ~# scp "/etc/pki/tls/certs/mysql/server/$IRPMASTER-ca-cert.pem" "$IRPSLAVE:/etc/pki/tls/certs/mysql/client/" root@IRPMASTER ~# scp "/etc/pki/tls/certs/mysql/client/$IRPMASTER-client-cert.pem" "$IRPSLAVE:/etc/pki/tls/certs/mysql/client/" root@IRPMASTER ~# scp "/etc/pki/tls/private/mysql/client/$IRPMASTER-client-key.pem" "$IRPSLAVE:/etc/pki/tls/private/mysql/client/" root@IRPMASTER ~# scp "$IRPSLAVE:/etc/pki/tls/certs/mysql/server/$IRPSLAVE-ca-cert.pem" "/etc/pki/tls/certs/mysql/client/" root@IRPMASTER ~# scp "$IRPSLAVE:/etc/pki/tls/certs/mysql/client/$IRPSLAVE-client-cert.pem" "/etc/pki/tls/certs/mysql/client/" root@IRPMASTER ~# scp "$IRPSLAVE:/etc/pki/tls/private/mysql/client/$IRPSLAVE-client-key.pem" "/etc/pki/tls/private/mysql/client/"
Listing 2.63: Set file permissions for keys and certificates
# chown -R mysql:mysql /etc/pki/tls/certs/mysql/ /etc/pki/tls/private/mysql/ # chmod 0600 /etc/pki/tls/private/mysql/server/* /etc/pki/tls/private/mysql/client/*
IRP includes a template config file /usr/share/doc/irp/irp.my_repl_slave.cnf.template. The template designates $IRPSLAVE as second server of the Multi-Master replication and includes references to $(hostname -s) that need to be replaced with the actual hostname of $IRPSLAVE before installing. Apply the changes and review the configuration file. Alternatively a command like the example below can be used to create $IRPSLAVE config file from template. Make sure to use the actual short hostname instead of the provided variable:
Listing 2.64: Example $IRPSLAVE configuration from template
root@IRPSLAVE ~# sed 's|$(hostname -s)|$IRPSLAVE|' < /usr/share/doc/irp/irp.my_repl_slave.cnf.template > /etc/noction/mysql/irp.my_repl_slave.cnf
The config file created above must be included into $IRPSLAVE node’s MySQL config my.cnf. It is recommended that line “!include /etc/noction/mysql/irp.my_repl_slave.cnf” is uncommented.
Listing 2.65: Check MySQL on $IRPSLAVE works correctly
root@IRPSLAVE ~# service mysqld start root@IRPSLAVE ~# tail -f /var/log/mysqld.log root@IRPSLAVE ~# mysql irp -e "show master status \G" root@IRPSLAVE ~# service mysqld stop
Alternatively a command like the example below can be used to create $IRPMASTER config file from template. Make sure to use the actual hostname instead of the provided variable:
Listing 2.66: Set $IRPMASTER as a first node for Multi-Master replication
root@IRPMASTER ~# sed 's|$(hostname -s)|$IRPMASTER|' < /usr/share/doc/irp/irp.my_repl_master.cnf.template > /etc/noction/mysql/irp.my_repl_master.cnf
Again, the config file created above must be included into $IRPMASTER node’s MySQL config my.cnf. It is recommended that line “!include /etc/noction/mysql/irp.my_repl_master.cnf” is uncommented.
Listing 2.67: Check MySQL on $IRPMASTER works correctly
root@IRPMASTER ~# service mysqld restart root@IRPMASTER ~# tail -f /var/log/mysqld.log root@IRPMASTER ~# mysql irp -e "show master status \G"
Listing 2.68: Replication user and grants
mysql> CREATE USER 'irprepl'@'<mysql_slave1_ip_address>' IDENTIFIED BY '<replication_user_password>'; mysql> GRANT REPLICATION SLAVE ON *.* TO 'irprepl'@'<mysql_masterslave1_ip_address>' REQUIRE CIPHER 'DHE-RSA-AES256-SHA'; mysql> CREATE USER 'irprepl'@'<mysql_master2_ip_address>' IDENTIFIED BY '<replication_user_password>'; mysql> GRANT REPLICATION SLAVE ON *.* TO 'irprepl'@'<mysql_slave2_ip_address>' REQUIRE CIPHER 'DHE-RSA-AES256-SHA';
Copy root’s .my.cnf config file if exists:
Listing 2.69: Copy database root user configuration file
root@IRPMASTER ~# scp /root/.my.cnf $IRPSLAVE:/root/
Copy config files:
Listing 2.70: Copy database configuration files
root@IRPMASTER ~# scp /etc/noction/db.global.conf $IRPSLAVE:/etc/noction/ root@IRPMASTER ~# scp /etc/noction/clickhouse/users.xml $IRPSLAVE:/etc/noction/clickhouse/
Listing 2.71: Copy database data files
root@IRPMASTER ~# rsync -av --progress --delete --delete-after --exclude="master.info" --exclude="relay-log.info" --exclude="*-bin.*" --exclude="*-relay.*" /var/lib/mysql/ $IRPSLAVE:/var/lib/mysql/
Listing 2.72: Copy differences of database files (OS with Systemd)
root@IRPMASTER ~# systemctl stop mariadb clickhouse-server # RedHat Enterprise Linux root@IRPMASTER ~# systemctl stop mysql clickhouse-server # Ubuntu root@IRPMASTER ~# systemctl start irp-stop-nobgpd.target systemctl start irp-shutdown-except-bgpd.target systemctl start irp-shutdown.target root@IRPMASTER ~# cd /var/lib/mysql && rm -vf ./master.info ./relay-log.info ./*-bin.* ./*-relay.* root@IRPMASTER ~# rsync -av --progress --delete --delete-after /var/lib/mysql/ $IRPSLAVE:/var/lib/mysql/
Listing 2.73: Set $IRPMASTER as replication slave
$IRPMASTER-mysql> CHANGE MASTER TO MASTER_HOST='$IRPSLAVE-ip-address', MASTER_USER='irprepl', MASTER_PASSWORD='$IRPSLAVE-password>', MASTER_PORT=3306, MASTER_LOG_FILE= '$IRPSLAVE--bin.000001', MASTER_LOG_POS= <$IRPSLAVE-bin-log-position>, MASTER_CONNECT_RETRY=10, MASTER_SSL=1, MASTER_SSL_CAPATH='/etc/pki/tls/certs/mysql/client/', MASTER_SSL_CA='/etc/pki/tls/certs/mysql/client/$IRPSLAVE-ca-cert.pem', MASTER_SSL_CERT='/etc/pki/tls/certs/mysql/client/$IRPSLAVE-client-cert.pem', MASTER_SSL_KEY='/etc/pki/tls/private/mysql/client/$IRPSLAVE-client-key.pem', MASTER_SSL_CIPHER='DHE-RSA-AES256-SHA';
You must manually check what values to assign to
Listing 2.74: Starting replication slave on $IRPMASTER
mysql> START SLAVE \G mysql> show slave status \G
Listing 2.75: Set $IRPSLAVE as replication slave
$IRPSLAVE-mysql> CHANGE MASTER TO MASTER_HOST='$IRPMASTER-ip-address', MASTER_USER='irprepl', MASTER_PASSWORD='$IRPMASTER-password>', MASTER_PORT=3306, MASTER_LOG_FILE= '$IRPMASTER-bin.000001', MASTER_LOG_POS= <$IRPMASTER-bin-log-position>, MASTER_CONNECT_RETRY=10, MASTER_SSL=1, MASTER_SSL_CAPATH='/etc/pki/tls/certs/mysql/client/', MASTER_SSL_CA='/etc/pki/tls/certs/mysql/client/$IRPMASTER-ca-cert.pem', MASTER_SSL_CERT='/etc/pki/tls/certs/mysql/client/$IRPMASTER-client-cert.pem', MASTER_SSL_KEY='/etc/pki/tls/private/mysql/client/$IRPMASTER-client-key.pem', MASTER_SSL_CIPHER='DHE-RSA-AES256-SHA';
You must manually check what values to assign to
Listing 2.76: Starting replication slave
mysql> START SLAVE \G mysql> show slave status \G
Listing 2.77: Starting IRP services and Frontend (OS with Systemd)
# systemctl start irp.target
Listing 2.78: Synchronize RRD
root@IRPMASTER ~ # rsync -av /var/spool/irp/ $IRPSLAVE:/var/spool/irp