New Member

Question

Fortigate and sFlow

Forum|Forum|11 years ago
November 25, 2014
7 replies
32568 views

Hi,

I am very new to Fortigate and I have been asked to look at enabling sFlow on a number of Fortigate firewalls as part of a monitoring strategy.

Unfortunately I have been informed that this has a negative effect on the Fastpath/Hardware Acceleration of the Fortigate and should not be used, can someone please advise.

Thanks in advance.

Adrian_Lewis

New Member

I can't confirm it but that does sound valid as sFlow uses sampling which AFAIK would involve the CPU (in the same way as packet capturing/sniffing). If this is the case, you might want to look at 5.2 and Netflow which may not have the same issues but again, this is not a definitive answer.

meubanksAuthor

New Member

Hi Adrian,

Thanks for that, I do expect to get some CPU overhead but I was told that this would adversely affect the Fastpath traffic flow, which as I understand is meant to avoid using the CPU. I have been looking everywhere for documentation that says don't use sFlow on fastpath interfaces or hardware accelerated interfaces and I can't find anything.

Thanks for you time

meubanksAuthor

New Member

Hi Ennoc,

We do use Netflow/IPFIX but sFlow tends to be lighter as it is more of a statistical tool sampling on 1 in N packets used for network weather maps. I have some doubt about the accuracy of the Fortigate sFlow implementation.

I came across this in the Fortigate OS Hardware Acceleration Handbook:

[size="3"]By default FortiOS does not record log messages for offloaded NP6 and NP4 sessions. This also means that traffic monitoring does not report correct session counts, byte counts and packet counts. [/size]

[size="3"]However, for NP6 processors you can use the following command to enable per-session accounting for each NP6 processor in the FortiGate unit.[/size]

[size="3"]For example, to enable session accounting for the first and second NP6 processors (np6_0 and np6_1): [/size]

So that seems to mean that the interface counters used in sFlow would be inaccurate at least on the NP4 processor and on the NP6 where the session counting is not enabled, what concerns me is I haven't been able to get any further information on what occurs on the non NP firewalls like those using the FortiSOC architecture.

meubanksAuthor

New Member

Hi Ennoc, We do use Netflow/IPFIX but sFlow tends to be lighter as it is more of a statistical tool sampling on 1 in N packets used for network weather maps. I have some doubt about the accuracy of the Fortigate sFlow implementation. I came across this in the Fortigate OS Hardware Acceleration Handbook: [size="3"]By default FortiOS does not record log messages for offloaded NP6 and NP4 sessions. This also means that traffic monitoring does not report correct session counts, byte counts and packet counts. [/size] [size="3"]However, for NP6 processors you can use the following command to enable per-session accounting for each NP6 processor in the FortiGate unit.[/size] [size="3"]For example, to enable session accounting for the first and second NP6 processors (np6_0 and np6_1): [/size] So that seems to mean that the interface counters used in sFlow would be inaccurate at least on the NP4 processor and on the NP6 where the session counting is not enabled, what concerns me is I haven't been able to get any further information on what occurs on the non NP firewalls like those using the FortiSOC architecture.

Adrian_Lewis

New Member

I think it may also depend on the NPU that is in your specific device. Again, not confirmed but I think the NP6 can handle sFlow sampling so might not be a significant hit if this is what's inside your FGT. Might just be a case of try it out and use diag commands to see if you can spot what sessions are or aren't fastpathed.

emnoc

New Member

I never heard of a fastpath impact with netflow or sflow, but be advise the sampler-interval & poll might missed a lot depending on what traffic is sampler and any thing that was punt out to the cpu. The cisco 6500 have already had this same issue. We seen that behavior in the DDoS NBA using Arbor flow collectors.

So spin her up and give her a try. What are you using sflow for if you don't mind me asking?

emnoc

New Member

I guess you need to test and report, but the real question is how many NP6 aware fortigate do you have ? how many np4? or nplite? And do you see ny npu acceleration in the diag system session ( look for npu info )

diag sys session list | grep offload

You might want to open a ticket with fortinet support on what's really happening on sampled flows with regards to sflow and even netflow ( btw which has no configurable sampler-rate that you can set but I heard it has a sampler rate predefined )

FWIW

I would really be surprised on that fortinet missed the boat with sflow exports. I know netfllow works to some degree but we are missing or seem template refresh problems so I think it's a little green and not 100% reliable.

Sign up

Login with SSO

Login to the community

Login with SSO