Allow multiple NetFlow collectors

FortiOS can be configured with a maximum of six NetFlow collectors. This also applies to multi-VDOM environments where a maximum of six NetFlow collectors can be used globally or on a per-VDOMs basis. This feature enables up to a maximum of six unique parallel NetFlow streams or transmissions per NetFlow sample to six different NetFlow collectors. The NetFlow collector configuration can only be configured in the CLI.

The netflow command is global, and utilized by the management VDOM. The vdom-netflow command is only available for non-management VDOMs.

config system {netflow | vdom-netflow}
    config collectors
        edit <id>
            set collector-ip <IP address>
            set collector-port <port>
            set source-ip <IP address>
            set interface-select-method {auto | sdwan | specify}
            set interface <interface>
        next
    end
end

collector-ip	Enter the IPv4 or IPv6 address of the NetFlow collector that NetFlow agents added to interfaces in this VDOM send NetFlow datagrams to.
collector-port	Enter the UDP port number used for sending NetFlow datagrams; only configure if it is required by the NetFlow collector or network configuration (0 - 65535, default = 6343).
source-ip	Enter the source IPv4 or IPv6 address for the NetFlow agent.
interface-select-method	Specify how to select the outgoing interface to reach the server. auto: Set the outgoing interface automatically. sdwan: Set the outgoing interface by SD-WAN or policy routing rules. specify: Set the outgoing interface manually.
interface <interface>	Enter the outgoing interface to reach the server.

If the interface-select-method is set to auto, the outgoing interface that is used to send the sampled NetFlow traffic to the NetFlow collector is decided by the routing table lookup.

Example 1: Multiple NetFlow collectors in a non-VDOM environment

In this example, six NetFlow collectors are configured in a non-VDOM environment with NetFlow sampling on the port1 interface.

To configure multiple NetFlow collectors:

1. Configure the NetFlow collectors:

   config system netflow
      config collectors
      set active-flow-timeout 60
      set template-tx-timeout 60
           edit 1
               set collector-ip 172.16.200.155
               set collector-port 2055
               set source-ip 172.16.200.6
               set interface-select-method specify
               set interface "port1"
           next
           edit 2
               set collector-ip 10.1.100.59
               set collector-port 2056
               set source-ip 10.1.100.6
               set interface-select-method specify
               set interface "port2"
           next
           edit 3
               set collector-ip 172.18.60.80
               set collector-port 2057
               set interface-select-method specify
               set interface "port1"
           next
           edit 4
               set collector-ip "172.18.60.1"
               set collector-port 2058
           next
           edit 5
               set collector-ip "172.18.60.3"
               set collector-port 2059
           next
           edit 6
               set collector-ip "172.18.60.4"
               set collector-port 2060
           next
       end
   end

2. Configure NetFlow sampling on port1:

   config system interface
       edit port1
           set netflow-sampler both
       next
   end

3. Verify the NetFlow diagnostics.

   1. Verify the NetFlow configuration status:

      # diagnose test application sflowd 3
      
      ===== Netflow Vdom Configuration =====
      Global collector(s) active-timeout(seconds):60 inactive-timeout(seconds):15
          Collector id:1: 172.16.200.155[2055] source IP:172.16.200.6
          Collector id:2: 10.1.100.59[2056] source IP:10.1.100.6
          Collector id:3: 172.18.60.80[2057] source IP:
          Collector id:4: 172.18.60.1[2058] source IP:
          Collector id:5: 172.18.60.3[2059] source IP:
          Collector id:6: 172.18.60.4[2060] source IP:
      ____ vdom: root, index=0, is master, collector: disabled (use global config) (mgmt vdom)
         |_ coll_ip:172.16.200.155:2056,src_ip:172.16.200.6
         |_ coll_ip:10.1.100.59:2057,src_ip:10.1.100.6
         |_ coll_ip:172.18.60.80:2058,src_ip:172.16.200.6
         |_ coll_ip:172.18.60.1:2058,src_ip:172.16.200.6
         |_ coll_ip:172.18.60.3:2059,src_ip:172.16.200.6
         |_ coll_ip:172.18.60.4:2060,src_ip:172.16.200.6
         |_ seq_num:13 pkts/time to next template: 16/29
         |_ exported: Bytes:2533746, Packets:3911, Sessions:70 Flows:70
         |_ active_intf: 1
         |____ interface:port1 sample_direction:both device_index:9 snmp_index:3

   2. Verify the sampled NetFlow traffic packet capture:

      # diagnose sniffer packet any 'udp and port 2056 or 2057 or 2058' 4
      
      filters=[udp and port 2056 or 2057 or 2058]
      5.717060 port1 out 172.16.200.6.2472 -> 172.16.200.155.2055: udp 60   
      5.717068 port2 out 10.1.100.6.2472 -> 10.1.100.59.2056: udp 60   
      5.717075 port1 out 172.16.200.6.2472 -> 172.18.60.80.2057: udp 60   
      5.717078 port1 out 172.16.200.6.2472 -> 172.18.60.1.2058: udp 60   
      5.717081 port1 out 172.16.200.6.2472 -> 172.18.60.3.2059: udp 60   
      5.717085 port1 out 172.16.200.6.2472 -> 172.18.60.4.2060: udp 60   

Example 2: Multiple NetFlow collectors in a multi-VDOM environment

In this example, six NetFlow collectors are configured in a multi-VDOM environment globally and per VDOM. NetFlow sampling is on the port1 and port4 interfaces.

Please note it is not mandatory to set up per-VDOM NetFlow collectors in a multi-vdom environment. However, if you don’t enable per-VDOM collectors, the settings of the global NetFlow Collector will be used instead.

To configure multiple NetFlow collectors:

1. Configure the global NetFlow collectors:

   config system netflow
      config collectors
      set active-flow-timeout 60
      set template-tx-timeout 60
           edit 1
               set collector-ip 172.16.200.155
               set collector-port 2055
               set source-ip 172.16.200.6
               set interface-select-method specify
               set interface "port1"
           next
           edit 2
               set collector-ip 10.1.100.59
               set collector-port 2056
               set source-ip 10.1.100.6
               set interface-select-method specify
               set interface "port2"
           next
           edit 3
               set collector-ip 172.18.60.80
               set collector-port 2057
               set interface-select-method specify
               set interface "port1"
           next
           edit 4
               set collector-ip "172.18.60.1"
               set collector-port 2058
           next
           edit 5
               set collector-ip "172.18.60.3"
               set collector-port 2059
           next
           edit 6
               set collector-ip "172.18.60.4"
               set collector-port 2060
           next
       end
   end

2. Configure the per-VDOM NetFlow collectors:

   config system vdom-netflow
       set vdom-netflow enable
       config collectors
           edit 1
               set collector-ip "172.10.100.101"
               set collector-port 2059
           next
           edit 2
               set collector-ip "172.10.100.102"
               set collector-port 2060
           next
           edit 3
               set collector-ip "172.10.100.103"
               set collector-port 2061
           next
           edit 4
               set collector-ip "172.10.100.104"
               set collector-port 2062
           next
           edit 5
               set collector-ip "172.10.100.105"
               set collector-port 2063
           next
           edit 6
               set collector-ip "172.10.100.106"
               set collector-port 2064
           next
       end
   end

3. Configure NetFlow sampling on port1 and port4:

   config system interface
       edit port1
           set netflow-sampler both
       next
       edit port4
           set netflow-sampler both
       next
   end

   In a multi-VDOM environment, ensure the interface selected for NetFlow sampling is in the same VDOM as the per-VDOM NetFlow collector. For global NetFlow collectors, the interface selected for NetFlow sampling should be in the management VDOM.

4. Verify the NetFlow diagnostics.

   1. Verify the NetFlow configuration status:

      # diagnose test application sflowd 3
      
      ===== Netflow Vdom Configuration =====
      Global collector(s) active-timeout(seconds):60 inactive-timeout(seconds):15
          Collector id:1: 172.16.200.155[2055] source IP:172.16.200.6
          Collector id:2: 10.1.100.59[2056] source IP:10.1.100.6
          Collector id:3: 172.18.60.80[2057] source IP:
          Collector id:4: 172.18.60.1[2058] source IP:
          Collector id:5: 172.18.60.3[2059] source IP:
          Collector id:6: 172.18.60.4[2060] source IP:
      ____ vdom: root, index=0, is master, collector: disabled (use global config) (mgmt vdom)
         |_ coll_ip:172.16.200.155:2056,src_ip:172.16.200.6
         |_ coll_ip:10.1.100.59:2057,src_ip:10.1.100.6
         |_ coll_ip:172.18.60.80:2058,src_ip:172.16.200.6
         |_ coll_ip:172.18.60.1:2058,src_ip:172.16.200.6
         |_ coll_ip:172.18.60.3:2059,src_ip:172.16.200.6
         |_ coll_ip:172.18.60.4:2060,src_ip:172.16.200.6
         |_ seq_num:13 pkts/time to next template: 16/29
         |_ exported: Bytes:2533746, Packets:3911, Sessions:70 Flows:70
         |_ active_intf: 1
         |____ interface:port1 sample_direction:both device_index:9 snmp_index:3
      ____ vdom: vdom1, index=1, is master, collector: enabled
         |_ coll_ip:172.10.100.101:2059,src_ip:20.1.100.111
         |_ coll_ip:172.10.100.102:2060,src_ip:20.1.100.111
         |_ coll_ip:172.10.100.103:2061,src_ip:20.1.100.111
         |_ coll_ip:172.10.100.104:2062,src_ip:20.1.100.111
         |_ coll_ip:172.10.100.105:2063,src_ip:20.1.100.111
         |_ coll_ip:172.10.100.106:2064,src_ip:20.1.100.111
         |_ seq_num:27 pkts/time to next template: 15/18
         |_ exported: Bytes:5040, Packets:60, Sessions:6 Flows:6
         |_ active_intf: 1
         |____ interface:port4 sample_direction:both device_index:12 snmp_index:6

   2. Verify the sampled NetFlow traffic packet capture:

      # diagnose sniffer packet any 'udp and port 2059 or 2060 or 2061 or 2062 or 2063 or 2064' 4
      
      filters=[udp and port 2059 or 2060 or 2061 or 2062 or 2063 or 2064]
      7.005812 port4 out 20.1.100.111.2472 -> 172.10.100.101.2059: udp 60
      7.005821 port4 out 20.1.100.111.2472 -> 172.10.100.102.2060: udp 60
      7.005826 port4 out 20.1.100.111.2472 -> 172.10.100.103.2061: udp 60
      7.005830 port4 out 20.1.100.111.2472 -> 172.10.100.104.2062: udp 60
      7.005834 port4 out 20.1.100.111.2472 -> 172.10.100.105.2063: udp 60
      7.005838 port4 out 20.1.100.111.2472 -> 172.10.100.106.2064: udp 60