NetFlow on FortiExtender and tunnel interfaces

NetFlow sampling is supported on FortiExtender and VPN tunnel interfaces.

VPN tunnel interfaces can be IPsec, IP in IP, or GRE tunnels. NetFlow sampling is supported on both NPU and non-NPU offloaded tunnels.

Examples

In the following examples, a FortiExtender and a VPN tunnel interface are configured with NetFlow sampling.

To configure a FortiExtender interface with NetFlow sampling:

1. Configure a FortiExtender interface with NetFlow sampling enabled for both transmitted and received traffic:

   config system interface
       edit "fext-211"
           set vdom "root"
           set mode dhcp
           set type fext-wan
           set netflow-sampler both
           set role wan
           set snmp-index 8
           set macaddr 2a:4e:68:a3:f4:6a
       next
   end

2. Check the NetFlow status and configuration:

   Device index 26 is the FortiExtender interface fext-211.

   # diagnose test application sflowd 3
   ===== Netflow Vdom Configuration =====
   Global collector:172.18.60.80:[2055] source ip: 0.0.0.0 active-timeout(seconds):60 inactive-timeout(seconds):600
   ____ vdom: root, index=0, is master, collector: disabled (use global config) (mgmt vdom)
      |_ coll_ip:172.18.60.80[2055],src_ip:10.6.30.105,seq_num:300,pkts/time to next template: 18/29
      |_ exported: Bytes:3026268, Packets:11192, Sessions:290 Flows:482
      |____ interface:fext-211 sample_direction:both device_index:26 snmp_index:8 

3. Check the network interface list:

   # diagnose netlink interface list
   ...
   if=fext-211 family=00 type=1 index=26 mtu=1500 link=0 master=0
   ref=27 state=start present fw_flags=60000 flags=up broadcast run multicast
   ...

4. Check the session list for the FortiExtender interface and NetFlow flowset packet:

   # diagnose sys session list
   session info: proto=1 proto_state=00 duration=1732 expire=59 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=may_dirty netflow-origin netflow-reply
   statistic(bytes/packets/allow_err): org=145572/1733/1 reply=145572/1733/1 tuples=2
   tx speed(Bps/kbps): 83/0 rx speed(Bps/kbps): 83/0
   orgin->sink: org pre->post, reply pre->post dev=5->26/26->5 gwy=10.39.252.244/172.16.200.55
   hook=post dir=org act=snat 172.16.200.55:61290->8.8.8.8:8(10.39.252.243:61290)
   hook=pre dir=reply act=dnat 8.8.8.8:61290->10.39.252.243:0(172.16.200.55:61290)
   misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0
   serial=00001298 tos=ff/ff app_list=0 app=0 url_cat=0
   sdwan_mbr_seq=0 sdwan_service_id=0
   rpdb_link_id=00000000 rpdb_svc_id=0 ngfwid=n/a
   npu_state=0x040000
   no_ofld_reason:  non-npu-intf
   total session 1

5. The flowset packet can be captured on UDP port 2055 by a packet analyzer, such as Wireshark:

   

To configure a VPN tunnel interface with NetFlow sampling:

1. Configure a VPN interface with NetFlow sampling enabled for both transmitted and received traffic:

   config system interface
       edit "A-to-B_vpn"
           set vdom "vdom1"
           set type tunnel
           set netflow-sampler both
           set snmp-index 42
           set interface "port3"
       next
   end

2. Configure the VPN tunnel:

   config vpn ipsec phase1-interface
       edit "A-to-B_vpn"
           set interface "port3"
           set peertype any
           set net-device disable
           set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
           set comments "VPN: A-to-B_vpn [Created by VPN wizard]"
           set wizard-type static-fortigate
           set remote-gw 10.2.2.2
           set psksecret ENC
       next
   end

   config vpn ipsec phase2-interface
       edit "A-to-B_vpn"
           set phase1name "A-to-B_vpn"
           set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
           set comments "VPN: A-to-B_vpn [Created by VPN wizard]"
           set src-addr-type name
           set dst-addr-type name
           set src-name "A-to-B_vpn_local"
           set dst-name "A-to-B_vpn_remote"
       next
   end

3. Check the NetFlow status and configuration:

   Device index 52 is the VPN interface A-to-B_vpn.

   # diagnose test application sflowd 3
   ===== Netflow Vdom Configuration =====
   Global collector:172.18.60.80:[2055] source ip: 0.0.0.0 active-timeout(seconds):60 inactive-timeout(seconds):15
   ____ vdom: vdom1, index=1, is master, collector: disabled (use global config) (mgmt vdom)
      |_ coll_ip:172.18.60.80[2055],src_ip:10.1.100.1,seq_num:60,pkts/time to next template: 15/6
      |_ exported: Bytes:11795591, Packets:48160, Sessions:10 Flows:34
      |____ interface:A-to-B_vpn sample_direction:both device_index:52 snmp_index:42

4. Check the session list for the VPN interface and NetFlow flowset packet (unencapsulated traffic going through the VPN tunnel):

   # diagnose sys session list
   session info: proto=6 proto_state=01 duration=6 expire=3599 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=may_dirty npu netflow-origin netflow-reply
   statistic(bytes/packets/allow_err): org=6433/120/1 reply=884384/713/1 tuples=2
   tx speed(Bps/kbps): 992/7 rx speed(Bps/kbps): 136479/1091
   orgin->sink: org pre->post, reply pre->post dev=10->52/52->10 gwy=10.2.2.2/10.1.100.22
   hook=pre dir=org act=noop 10.1.100.22:43714->172.16.200.55:80(0.0.0.0:0)
   hook=post dir=reply act=noop 172.16.200.55:80->10.1.100.22:43714(0.0.0.0:0)
   pos/(before,after) 0/(0,0), 0/(0,0)
   src_mac=00:0c:29:ac:ae:4f
   misc=0 policy_id=5 auth_info=0 chk_client_info=0 vd=1
   serial=00003b6c tos=ff/ff app_list=0 app=0 url_cat=0
   sdwan_mbr_seq=0 sdwan_service_id=0
   rpdb_link_id=00000000 rpdb_svc_id=0 ngfwid=n/a
   npu_state=0x000001 no_offload
   npu info: flag=0x82/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0x0000/0x0000
   vlifid=0/0, vtag_in=0x0000/0x0000 in_npu=0/0, out_npu=0/0, fwd_en=0/0, qid=0/0
   no_ofld_reason:  disabled-by-policy
   total session 1

5. The flowset packet can be captured on UDP port 2055 by a packet analyzer, such as Wireshark: