Monitoring a Multi-Site Deployment
A university with 3 campuses and 1,200 APs and 300 switches is deploying a new management platform. Today each campus uses local SNMP polling with 5-minute intervals; outages are often discovered by users. The network team has 4 engineers and wants centralized visibility, alerting, and historical reporting. The WAN between campuses is 1 Gbps with 40 ms latency, and the smallest campus has only 20 Mbps of spare bandwidth. Compliance requires 90 days of flow and performance data retention.
1. Design the monitoring architecture: where do collectors live, and what polling intervals are appropriate?
Read the worked answer
Architecture: distributed collectors, centralized manager.
- Place a collector per campus to poll local devices at 1-minute intervals for availability and interface stats, and 5-minute intervals for CPU/memory and environmental data. Local polling keeps latency and WAN load low.
- Collectors stream summarized data to the central manager over the 1 Gbps WAN; raw flow records are aggregated locally before export.
- The 20 Mbps campus should not stream raw flows centrally - retain raw flows locally for 90 days and forward only summaries and alerts.
Sizing check: 1,200 APs + 300 switches at 1-minute polling is roughly 25 polls/second spread across collectors - trivial per campus. Central WAN impact is dominated by flow export; aggregate locally to keep it under a few Mbps.
2. How do you meet 90-day flow retention without overloading the small campus link?
Read the worked answer
Tiered retention:
- Local raw flow storage at each campus for 90 days (compliance satisfied locally).
- Central storage of aggregated flows (5-minute rollups) for 90 days and raw flows for 7–14 days for troubleshooting.
- Export only summaries from the 20 Mbps campus; if auditors require raw flows centrally, schedule off-peak bulk transfers within a bandwidth cap (e.g., 5 Mbps) so the link is not saturated.
Validate: estimate flow volume - 1,200 APs generating ~50 flows/minute each is 60,000 flows/minute; NetFlow at ~100 bytes/record is about 1 MB/minute, or ~1.4 GB/day raw. Aggregation cuts this by an order of magnitude, keeping the small campus well within its spare bandwidth.