Hello,
I have 3 question regarding netflow/sflow and hope in this room there are anybody who can help me.
1. As i know fortinet have netflow and sflow feature, which one is more recommended to use?
2. If we apply netflow/sflow in outside interface it's true that captured traffic only showing conversation from NATed Public IP to the internet?
3. If we apply netflow/sflow in inside interface it's true that captured traffic only showing conversation from private ip to the internet?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
In the meantime, perhaps this document will help you decide which type is best for your network to use: https://docs.fortinet.com/document/fortigate/7.2.4/hardware-acceleration/631057/sflow-and-netflow-an...
Thanks,
Hi,
I think these links will have most of the answers for your questions.
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/998643/netflow
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/505119/sflow
I am not sure which is better, probably sFlow as it has more information about the traffic, but personally I don't have experience with sFlow.
Hi, I did both, and from experience:
Created on 02-18-2024 11:11 PM Edited on 02-18-2024 11:11 PM
Hi,
I tried the sFlow and got the following result. If the sampler was set to 1/10, then when I sent 1GB of traffic, I saw 100MB in collector. If the sampler is 1/100, then I saw 10MB. If 1/1000, then 1MB. Is this the correct sFlow behavior?
Thanks.
Nobody knows. Misfortune.
Hi Kuzma,
I recommend creating a new support forum thread to maximize the amount of views you get. Feel free to link to this related thread.
Kind regards,
Stephen
Hi, sorry for the late reply.
The sampling is done over number of packets, not their rate or volume. That is - setting sample to 1/10 means sFlow will take into account every 10th packet. This means for the traffic with varying size your calculation wouldn't be 100% correct. It would be correct for uniform-sized traffic, say using iperf where each packet is more or less equal in size, 1/10 sample of 100 Mb will mean 1 Gb of real traffic.
In real life scenario, you can have 9 packets of 100 bytes and 10th packet (the one accounted for in the sample) of 1 Mbyte. But, given the high rates of traffic of today and nature of the traffic, the sampling will be actually quite close to the real traffic. To read more see https://sflow.org/packetSamplingBasics/
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1529 | |
1027 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.