Fortigate and sFlow

[meubanks]

Hi,

I am very new to Fortigate and I have been asked to look at enabling sFlow on a number of Fortigate firewalls as part of a monitoring strategy.

Unfortunately I have been informed that this has a negative effect on the Fastpath/Hardware Acceleration of the Fortigate and should not be used, can someone please advise.

Thanks in advance.

[Adrian_Lewis]

I can't confirm it but that does sound valid as sFlow uses sampling which AFAIK would involve the CPU (in the same way as packet capturing/sniffing). If this is the case, you might want to look at 5.2 and Netflow which may not have the same issues but again, this is not a definitive answer.

[meubanks]

Hi Adrian,

Thanks for that, I do expect to get some CPU overhead but I was told that this would adversely affect the Fastpath traffic flow, which as I understand is meant to avoid using the CPU.  I have been looking everywhere for documentation that says don't use sFlow on fastpath interfaces or hardware accelerated interfaces and I can't find anything.

Thanks for you time

[meubanks]

Hi Ennoc,

We do use Netflow/IPFIX but sFlow tends to be lighter as it is more of a statistical tool sampling on 1 in N packets used for network weather maps. I have some doubt about the accuracy of the Fortigate sFlow implementation.

I came across this in the Fortigate OS Hardware Acceleration Handbook:

[size="3"]By default FortiOS does not record log messages for offloaded NP6 and NP4 sessions. This also means that traffic monitoring does not report correct session counts, byte counts and packet counts. [/size][size="3"]However, for NP6 processors you can use the following command to enable per-session accounting for each NP6 processor in the FortiGate unit.[/size][size="3"]For example, to enable session accounting for the first and second NP6 processors (np6_0 and np6_1): [/size]

So that seems to mean that the interface counters used in sFlow would be inaccurate at least on the NP4 processor and on the NP6 where the session counting is not enabled, what concerns me is I haven't been able to get any further information on what occurs on the non NP firewalls like those using the FortiSOC architecture.

[meubanks]

Hi Ennoc,   We do use Netflow/IPFIX but sFlow tends to be lighter as it is more of a statistical tool sampling on 1 in N packets used for network weather maps. I have some doubt about the accuracy of the Fortigate sFlow implementation.   I came across this in the Fortigate OS Hardware Acceleration Handbook: [size="3"]By default FortiOS does not record log messages for offloaded NP6 and NP4 sessions. This also means that traffic monitoring does not report correct session counts, byte counts and packet counts. [/size] [size="3"]However, for NP6 processors you can use the following command to enable per-session accounting for each NP6 processor in the FortiGate unit.[/size] [size="3"]For example, to enable session accounting for the first and second NP6 processors (np6_0 and np6_1): [/size]   So that seems to mean that the interface counters used in sFlow would be inaccurate at least on the NP4 processor and on the NP6 where the session counting is not enabled, what concerns me is I haven't been able to get any further information on what occurs on the non NP firewalls like those using the FortiSOC architecture.

[Adrian_Lewis]

I think it may also depend on the NPU that is in your specific device. Again, not confirmed but I think the NP6 can handle sFlow sampling so might not be a significant hit if this is what's inside your FGT. Might just be a case of try it out and use diag commands to see if you can spot what sessions are or aren't fastpathed.

[emnoc]

I never heard of a fastpath impact with netflow or sflow, but be advise the sampler-interval  & poll might missed a lot depending on what  traffic is sampler and any thing that was punt out to the cpu. The cisco 6500 have already had this same issue. We seen that behavior in the DDoS  NBA using Arbor flow collectors.

So spin her up and give her a try. What are you using  sflow for if you don't mind me asking?

[emnoc]

I guess you need to test and report, but the real question is how many NP6 aware  fortigate do you have ? how many np4? or nplite? And do you see ny npu acceleration in the  diag system session ( look for npu info )

diag sys session list | grep offload

You might want to open a ticket with  fortinet support on what's really happening on sampled flows with regards to sflow and even netflow ( btw which has no configurable sampler-rate that you can set but I heard it has a sampler rate predefined )

FWIW

I would really be surprised on that fortinet missed the boat with sflow exports. I know netfllow works to some degree but we are  missing or seem template refresh problems so I think it's a little green and not 100% reliable.