NetFlow on FortiExtender and tunnel interfaces

NetFlow sampling is supported on FortiExtender and VPN tunnel interfaces.

VPN tunnel interfaces can be IPsec, IP in IP, or GRE tunnels. NetFlow sampling is supported on both NPU and non-NPU offloaded tunnels.

Examples

In the following examples, a FortiExtender and a VPN tunnel interface are configured with NetFlow sampling.

To configure a FortiExtender interface with NetFlow sampling:
  1. Configure a FortiExtender interface with NetFlow sampling enabled for both transmitted and received traffic:

    config system interface
        edit "fext-211"
            set vdom "root"
            set mode dhcp
            set type fext-wan
            set netflow-sampler both
            set role wan
            set snmp-index 8
            set macaddr 2a:4e:68:a3:f4:6a
        next
    end
  2. Check the NetFlow status and configuration:

    Device index 26 is the FortiExtender interface fext-211.

    # diagnose test application sflowd 3
    ===== Netflow Vdom Configuration =====
    Global collector:172.18.60.80:[2055] source ip: 0.0.0.0 active-timeout(seconds):60 inactive-timeout(seconds):600
    ____ vdom: root, index=0, is master, collector: disabled (use global config) (mgmt vdom)
       |_ coll_ip:172.18.60.80[2055],src_ip:10.6.30.105,seq_num:300,pkts/time to next template: 18/29
       |_ exported: Bytes:3026268, Packets:11192, Sessions:290 Flows:482
       |____ interface:fext-211 sample_direction:both device_index:26 snmp_index:8 
  3. Check the network interface list:

    # diagnose netlink interface list
    ...
    if=fext-211 family=00 type=1 index=26 mtu=1500 link=0 master=0
    ref=27 state=start present fw_flags=60000 flags=up broadcast run multicast
    ...
  4. Check the session list for the FortiExtender interface and NetFlow flowset packet:

    # diagnose sys session list
    session info: proto=1 proto_state=00 duration=1732 expire=59 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
    origin-shaper=
    reply-shaper=
    per_ip_shaper=
    class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
    state=may_dirty netflow-origin netflow-reply
    statistic(bytes/packets/allow_err): org=145572/1733/1 reply=145572/1733/1 tuples=2
    tx speed(Bps/kbps): 83/0 rx speed(Bps/kbps): 83/0
    orgin->sink: org pre->post, reply pre->post dev=5->26/26->5 gwy=10.39.252.244/172.16.200.55
    hook=post dir=org act=snat 172.16.200.55:61290->8.8.8.8:8(10.39.252.243:61290)
    hook=pre dir=reply act=dnat 8.8.8.8:61290->10.39.252.243:0(172.16.200.55:61290)
    misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0
    serial=00001298 tos=ff/ff app_list=0 app=0 url_cat=0
    sdwan_mbr_seq=0 sdwan_service_id=0
    rpdb_link_id=00000000 rpdb_svc_id=0 ngfwid=n/a
    npu_state=0x040000
    no_ofld_reason:  non-npu-intf
    total session 1
  5. The flowset packet can be captured on UDP port 2055 by a packet analyzer, such as Wireshark:

To configure a VPN tunnel interface with NetFlow sampling:
  1. Configure a VPN interface with NetFlow sampling enabled for both transmitted and received traffic:

    config system interface
        edit "A-to-B_vpn"
            set vdom "vdom1"
            set type tunnel
            set