Fortinet black logo

Administration Guide

NetFlow on FortiExtender and tunnel interfaces

NetFlow on FortiExtender and tunnel interfaces

NetFlow sampling is supported on FortiExtender and VPN tunnel interfaces.

VPN tunnel interfaces can be IPsec, IP in IP, or GRE tunnels. NetFlow sampling is supported on both NPU and non-NPU offloaded tunnels.

Examples

In the following examples, a FortiExtender and a VPN tunnel interface are configured with NetFlow sampling.

To configure a FortiExtender interface with NetFlow sampling:
  1. Configure a FortiExtender interface with NetFlow sampling enabled for both transmitted and received traffic:

    config system interface
        edit "fext-211"
            set vdom "root"
            set mode dhcp
            set type fext-wan
            set netflow-sampler both
            set role wan
            set snmp-index 8
            set macaddr 2a:4e:68:a3:f4:6a
        next
    end
  2. Check the NetFlow status and configuration:

    Device index 26 is the FortiExtender interface fext-211.

    # diagnose test application sflowd 3
    ===== Netflow Vdom Configuration =====
    Global collector:172.18.60.80:[2055] source ip: 0.0.0.0 active-timeout(seconds):60 inactive-timeout(seconds):600
    ____ vdom: root, index=0, is master, collector: disabled (use global config) (mgmt vdom)
       |_ coll_ip:172.18.60.80[2055],src_ip:10.6.30.105,seq_num:300,pkts/time to next template: 18/29
       |_ exported: Bytes:3026268, Packets:11192, Sessions:290 Flows:482
       |____ interface:fext-211 sample_direction:both device_index:26 snmp_index:8 
  3. Check the network interface list:

    # diagnose netlink interface list
    ...
    if=fext-211 family=00 type=1 index=26 mtu=1500 link=0 master=0
    ref=27 state=start present fw_flags=60000 flags=up broadcast run multicast
    ...
  4. Check the session list for the FortiExtender interface and NetFlow flowset packet:

    # diagnose sys session list
    session info: proto=1 proto_state=00 duration=1732 expire=59 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
    origin-shaper=
    reply-shaper=
    per_ip_shaper=
    class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
    state=may_dirty netflow-origin netflow-reply
    statistic(bytes/packets/allow_err): org=145572/1733/1 reply=145572/1733/1 tuples=2
    tx speed(Bps/kbps): 83/0 rx speed(Bps/kbps): 83/0
    orgin->sink: org pre->post, reply pre->post dev=5->26/26->5 gwy=10.39.252.244/172.16.200.55
    hook=post dir=org act=snat 172.16.200.55:61290->8.8.8.8:8(10.39.252.243:61290)
    hook=pre dir=reply act=dnat 8.8.8.8:61290->10.39.252.243:0(172.16.200.55:61290)
    misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0
    serial=00001298 tos=ff/ff app_list=0 app=0 url_cat=0
    sdwan_mbr_seq=0 sdwan_service_id=0
    rpdb_link_id=00000000 rpdb_svc_id=0 ngfwid=n/a
    npu_state=0x040000
    no_ofld_reason:  non-npu-intf
    total session 1
  5. The flowset packet can be captured on UDP port 2055 by a packet analyzer, such as Wireshark:

To configure a VPN tunnel interface with NetFlow sampling:
  1. Configure a VPN interface with NetFlow sampling enabled for both transmitted and received traffic:

    config system interface
        edit "A-to-B_vpn"
            set vdom "vdom1"
            set type tunnel
            set netflow-sampler both
            set snmp-index 42
            set interface "port3"
        next
    end
  2. Configure the VPN tunnel:

    config vpn ipsec phase1-interface
        edit "A-to-B_vpn"
            set interface "port3"
            set peertype any
            set net-device disable
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
            set comments "VPN: A-to-B_vpn [Created by VPN wizard]"
            set wizard-type static-fortigate
            set remote-gw 10.2.2.2
            set psksecret ENC
        next
    end
    config vpn ipsec phase2-interface
        edit "A-to-B_vpn"
            set phase1name "A-to-B_vpn"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set comments "VPN: A-to-B_vpn [Created by VPN wizard]"
            set src-addr-type name
            set dst-addr-type name
            set src-name "A-to-B_vpn_local"
            set dst-name "A-to-B_vpn_remote"
        next
    end
  3. Check the NetFlow status and configuration:

    Device index 52 is the VPN interface A-to-B_vpn.

    # diagnose test application sflowd 3
    ===== Netflow Vdom Configuration =====
    Global collector:172.18.60.80:[2055] source ip: 0.0.0.0 active-timeout(seconds):60 inactive-timeout(seconds):15
    ____ vdom: vdom1, index=1, is master, collector: disabled (use global config) (mgmt vdom)
       |_ coll_ip:172.18.60.80[2055],src_ip:10.1.100.1,seq_num:60,pkts/time to next template: 15/6
       |_ exported: Bytes:11795591, Packets:48160, Sessions:10 Flows:34
       |____ interface:A-to-B_vpn sample_direction:both device_index:52 snmp_index:42
  4. Check the session list for the VPN interface and NetFlow flowset packet (unencapsulated traffic going through the VPN tunnel):

    # diagnose sys session list
    session info: proto=6 proto_state=01 duration=6 expire=3599 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
    origin-shaper=
    reply-shaper=
    per_ip_shaper=
    class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
    state=may_dirty npu netflow-origin netflow-reply
    statistic(bytes/packets/allow_err): org=6433/120/1 reply=884384/713/1 tuples=2
    tx speed(Bps/kbps): 992/7 rx speed(Bps/kbps): 136479/1091
    orgin->sink: org pre->post, reply pre->post dev=10->52/52->10 gwy=10.2.2.2/10.1.100.22
    hook=pre dir=org act=noop 10.1.100.22:43714->172.16.200.55:80(0.0.0.0:0)
    hook=post dir=reply act=noop 172.16.200.55:80->10.1.100.22:43714(0.0.0.0:0)
    pos/(before,after) 0/(0,0), 0/(0,0)
    src_mac=00:0c:29:ac:ae:4f
    misc=0 policy_id=5 auth_info=0 chk_client_info=0 vd=1
    serial=00003b6c tos=ff/ff app_list=0 app=0 url_cat=0
    sdwan_mbr_seq=0 sdwan_service_id=0
    rpdb_link_id=00000000 rpdb_svc_id=0 ngfwid=n/a
    npu_state=0x000001 no_offload
    npu info: flag=0x82/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0x0000/0x0000
    vlifid=0/0, vtag_in=0x0000/0x0000 in_npu=0/0, out_npu=0/0, fwd_en=0/0, qid=0/0
    no_ofld_reason:  disabled-by-policy
    total session 1
  5. The flowset packet can be captured on UDP port 2055 by a packet analyzer, such as Wireshark:

NetFlow on FortiExtender and tunnel interfaces

NetFlow sampling is supported on FortiExtender and VPN tunnel interfaces.

VPN tunnel interfaces can be IPsec, IP in IP, or GRE tunnels. NetFlow sampling is supported on both NPU and non-NPU offloaded tunnels.

Examples

In the following examples, a FortiExtender and a VPN tunnel interface are configured with NetFlow sampling.

To configure a FortiExtender interface with NetFlow sampling:
  1. Configure a FortiExtender interface with NetFlow sampling enabled for both transmitted and received traffic:

    config system interface
        edit "fext-211"
            set vdom "root"
            set mode dhcp
            set type fext-wan
            set netflow-sampler both
            set role wan
            set snmp-index 8
            set macaddr 2a:4e:68:a3:f4:6a
        next
    end
  2. Check the NetFlow status and configuration:

    Device index 26 is the FortiExtender interface fext-211.

    # diagnose test application sflowd 3
    ===== Netflow Vdom Configuration =====
    Global collector:172.18.60.80:[2055] source ip: 0.0.0.0 active-timeout(seconds):60 inactive-timeout(seconds):600
    ____ vdom: root, index=0, is master, collector: disabled (use global config) (mgmt vdom)
       |_ coll_ip:172.18.60.80[2055],src_ip:10.6.30.105,seq_num:300,pkts/time to next template: 18/29
       |_ exported: Bytes:3026268, Packets:11192, Sessions:290 Flows:482
       |____ interface:fext-211 sample_direction:both device_index:26 snmp_index:8 
  3. Check the network interface list:

    # diagnose netlink interface list
    ...
    if=fext-211 family=00 type=1 index=26 mtu=1500 link=0 master=0
    ref=27 state=start present fw_flags=60000 flags=up broadcast run multicast
    ...
  4. Check the session list for the FortiExtender interface and NetFlow flowset packet:

    # diagnose sys session list
    session info: proto=1 proto_state=00 duration=1732 expire=59 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
    origin-shaper=
    reply-shaper=
    per_ip_shaper=
    class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
    state=may_dirty netflow-origin netflow-reply
    statistic(bytes/packets/allow_err): org=145572/1733/1 reply=145572/1733/1 tuples=2
    tx speed(Bps/kbps): 83/0 rx speed(Bps/kbps): 83/0
    orgin->sink: org pre->post, reply pre->post dev=5->26/26->5 gwy=10.39.252.244/172.16.200.55
    hook=post dir=org act=snat 172.16.200.55:61290->8.8.8.8:8(10.39.252.243:61290)
    hook=pre dir=reply act=dnat 8.8.8.8:61290->10.39.252.243:0(172.16.200.55:61290)
    misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0
    serial=00001298 tos=ff/ff app_list=0 app=0 url_cat=0
    sdwan_mbr_seq=0 sdwan_service_id=0
    rpdb_link_id=00000000 rpdb_svc_id=0 ngfwid=n/a
    npu_state=0x040000
    no_ofld_reason:  non-npu-intf
    total session 1
  5. The flowset packet can be captured on UDP port 2055 by a packet analyzer, such as Wireshark:

To configure a VPN tunnel interface with NetFlow sampling:
  1. Configure a VPN interface with NetFlow sampling enabled for both transmitted and received traffic:

    config system interface
        edit "A-to-B_vpn"
            set vdom "vdom1"
            set type tunnel
            set netflow-sampler both
            set snmp-index 42
            set interface "port3"
        next
    end
  2. Configure the VPN tunnel:

    config vpn ipsec phase1-interface
        edit "A-to-B_vpn"
            set interface "port3"
            set peertype any
            set net-device disable
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
            set comments "VPN: A-to-B_vpn [Created by VPN wizard]"
            set wizard-type static-fortigate
            set remote-gw 10.2.2.2
            set psksecret ENC
        next
    end
    config vpn ipsec phase2-interface
        edit "A-to-B_vpn"
            set phase1name "A-to-B_vpn"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set comments "VPN: A-to-B_vpn [Created by VPN wizard]"
            set src-addr-type name
            set dst-addr-type name
            set src-name "A-to-B_vpn_local"
            set dst-name "A-to-B_vpn_remote"
        next
    end
  3. Check the NetFlow status and configuration:

    Device index 52 is the VPN interface A-to-B_vpn.

    # diagnose test application sflowd 3
    ===== Netflow Vdom Configuration =====
    Global collector:172.18.60.80:[2055] source ip: 0.0.0.0 active-timeout(seconds):60 inactive-timeout(seconds):15
    ____ vdom: vdom1, index=1, is master, collector: disabled (use global config) (mgmt vdom)
       |_ coll_ip:172.18.60.80[2055],src_ip:10.1.100.1,seq_num:60,pkts/time to next template: 15/6
       |_ exported: Bytes:11795591, Packets:48160, Sessions:10 Flows:34
       |____ interface:A-to-B_vpn sample_direction:both device_index:52 snmp_index:42
  4. Check the session list for the VPN interface and NetFlow flowset packet (unencapsulated traffic going through the VPN tunnel):

    # diagnose sys session list
    session info: proto=6 proto_state=01 duration=6 expire=3599 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
    origin-shaper=
    reply-shaper=
    per_ip_shaper=
    class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
    state=may_dirty npu netflow-origin netflow-reply
    statistic(bytes/packets/allow_err): org=6433/120/1 reply=884384/713/1 tuples=2
    tx speed(Bps/kbps): 992/7 rx speed(Bps/kbps): 136479/1091
    orgin->sink: org pre->post, reply pre->post dev=10->52/52->10 gwy=10.2.2.2/10.1.100.22
    hook=pre dir=org act=noop 10.1.100.22:43714->172.16.200.55:80(0.0.0.0:0)
    hook=post dir=reply act=noop 172.16.200.55:80->10.1.100.22:43714(0.0.0.0:0)
    pos/(before,after) 0/(0,0), 0/(0,0)
    src_mac=00:0c:29:ac:ae:4f
    misc=0 policy_id=5 auth_info=0 chk_client_info=0 vd=1
    serial=00003b6c tos=ff/ff app_list=0 app=0 url_cat=0
    sdwan_mbr_seq=0 sdwan_service_id=0
    rpdb_link_id=00000000 rpdb_svc_id=0 ngfwid=n/a
    npu_state=0x000001 no_offload
    npu info: flag=0x82/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0x0000/0x0000
    vlifid=0/0, vtag_in=0x0000/0x0000 in_npu=0/0, out_npu=0/0, fwd_en=0/0, qid=0/0
    no_ofld_reason:  disabled-by-policy
    total session 1
  5. The flowset packet can be captured on UDP port 2055 by a packet analyzer, such as Wireshark: