New Member

Solved

Setup of Netflow

Forum|Forum|10 years ago
September 6, 2015
7 replies
29365 views

I'm attempting to setup netflow and am not having any luck. I have a fortigate 80C and am using PRTG for monitoring. I followed these instructions found from Fortinet, but the probe says no information has been sent to it.

config system netflow set collector-ip <address> set collector-port <port> set source-ip <address> set active-flow-timeout <integer> set inactive-flow-timeout <integer> end I set the collector IP as the server address that has the PRTG probe on it, the port to a UDP port that wasn't used, and it matches what PRTG is looking for and I made sure there was a rule in the local firewall to allow it. The source IP I wasn't sure exactly what should be used, so I entered the routers IP address, and the timers I set to 1 and 15 respectively. Any insights on how to get this fixed would be very helpful, I'm looking forward to collecting the data on my WAN usage. Thanks Jon

Best answer by emnoc

You have to enable the interface.

e.g

edit "internal1" set vdom "custA" set ip 10.100.10.1 255.255.255.0 set allowaccess ping https ssh set vlanforward enable set type physical set netflow-sampler tx <---------- set alias "internal1-interface" set lldp-transmission enable set snmp-index 2 config ipv6 set ip6-mode dhcp set ip6-allowaccess ping https ssh end next end

emnocAnswer

New Member

You have to enable the interface.

e.g

edit "internal1" set vdom "custA" set ip 10.100.10.1 255.255.255.0 set allowaccess ping https ssh set vlanforward enable set type physical set netflow-sampler tx <---------- set alias "internal1-interface" set lldp-transmission enable set snmp-index 2 config ipv6 set ip6-mode dhcp set ip6-allowaccess ping https ssh end next end

Jon_MillerAuthor

New Member

I might need some help with the commands to accomplish this. I am proficient with the gui and have a good amount of experience with ios command line, but am a bit fuzzy on fortinets until I get some more practice.

Will I be using a command like this?

config system interface

edit internal

set netflow-sampler tx

Thanks for the help!

Jon

emnoc

New Member

Yes, and your options are tx/rx or both. So determine what directions you need.

vjoshi_FTNT

Staff

Hello,

Below KB article explains how to configure the netflow with a scenario and also has a basic debugging help:

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36460

Hope that helps.

Dipen

New Member

Is NetFlow Advantageous to sFlow. Which FortiOS starts supporting netFlow. ?

vjoshi_FTNT

Staff

sFlow samples anything and is network layer independent (e.g. IPX, NetBEUI, IP, etc.) and can monitor the upper layer traffic as well.

NetFlow accounts for 100% of everything IP based (i.e. not IPX, NetBEUI, etc.)

Dipen wrote:
Is NetFlow Advantageous to sFlow. Which FortiOS starts supporting netFlow. ?

emnoc

New Member

They are not the same. Netflow probably has been around much longer than sflow due to cisco implementation. Sflow biggest positive is that it can support layer2 information in the flow details. Netflow imho and experience shine in DDoS detection and traffic-engineering and trending.

I would research here since myself and others have seen issues ( mainly sflow ) that shows packet stacking against the cpu or other issues. I would love to see a big outfit deploy sflow across a wide number of FGT appliances and have a cook-off.

In all of the approaches you need to be cautious of the sampler rate, and should provide a sampler. YMMV but FTNT has supported sflow for some time, I believe since 4 Mr3 in most appliances , but 5.0.x is where netflow started appearing in most FGT appliances iirc.

FWIW: A lot of netflow collectors don't support sflow flow records , so make sure your collector is sflow supported and the sampler interval that it can support.

Ken

Sign up

Login with SSO

Login to the community

Login with SSO