NetFlow

NetFlow allows you to collect IP network traffic statistics for an interface, and then export those statistics for analysis. NetFlow samplers, that sample every packet, are configured per interface. Full NetFlow is supported through the information maintained in the firewall session.

To configure NetFlow:

config system netflow
    set active-flow-timeout <integer>
    set inactive-flow-timeout <integer>
    set template-tx-timeout <integer>
    set template-tx-counter <integer>
    config collectors
        edit <id>
            set collector-ip <IP address>
            set collector-port <port>
            set source-ip <IP address>
            set interface-select-method {auto | sdwan | specify}
            set interface <interface>
        next
    end
end

The source-ip-interface and source-ip commands are unavailable for NetFlow configurations when ha-direct is enabled. (See config system ha in the CLI Reference guide). The source-ip-interface and source-ip commands are also mutually exclusive; they cannot be used at the same time, but one or the other can be used together with the interface-select-method command

active-flow-timeout <integer>	Timeout to report active flows, in seconds (60 - 3600, default = 1800).
inactive-flow-timeout <integer>	Timeout for periodic report of finished flows, in seconds (10 - 600, default = 15).
template-tx-timeout <integer>	Timeout for periodic template flowset transmission, in seconds (60 - 86400, default = 1800).
template-tx-counter <integer>	Counter of flowset records, before resending a template flowset record (10 - 6000, default = 20).
collector-ip <ip>	Collector IPv4 or IPv6 address.
collector-port <port>	NetFlow collector port number (0 - 65535).
source-ip <ip>	Source IPv4 or IPv6 address, for communication with the NetFlow agent.
interface-select-method {auto | sdwan | specify}	Routing of the NetFlow messages is determined by the selected method. If neither source-ip-interface nor source-ip is configured, then the source address of the message is the IP address of the interface selected by the interface select method. See Local out traffic for details.
source-ip-interface <name>	Utilize the IP address of the specified interface as the source when sending out the NetFlow messages. Routing of the messages does not change based on this setting. The source-ip-interface is unavailable for NetFlow configurations when FortiGate is in transparent VDOM mode.
interface <interface>	The outgoing interface to reach the server.

To configure NetFlow in a specific, non-management VDOM:

config vdom
    edit <vdom>
        config system vdom-netflow
            set vdom-netflow enable
            config collectors
                edit <id>
                    set collector-ip <IP address>
                    set collector-port <port>
                    set source-ip <IP address>
                    set interface-select-method {auto | sdwan | specify}
                    set interface <interface>
                next
            end
        end
    next
end

The vdom-netflow command is only available for non-management VDOMs. The management VDOM utilizes the global NetFlow settings.

To configure a NetFlow sampler on an interface:

config system interface
    edit <interface>
        set netflow-sampler {disable | tx | rx | both}
    next
end

disable	Disable the NetFlow protocol on this interface (default).
tx	Monitor transmitted traffic on this interface.
rx	Monitor received traffic on this interface.
both	Monitor transmitted/received traffic on this interface.

Verification and troubleshooting

If data are not seen on the NetFlow collector after it has been configured, use the following sniffer commands to verify if the FortiGate and the collector are communicating:

• By collector port:

  # diagnose sniffer packet 'port <collector-port>'  6 0 a

• By collector IP address:

  # diagnose sniffer packet 'host <collector-ip>' 6 0 a

NetFlow uses the sflow daemon. The current NetFlow configuration can be viewed using test level 3 or 4:

# diagnose test application sflowd 3

# diagnose test application sflowd 4
Netflow Cache Stats:
vdoms=1 Collectors=1 Cached_intf=2 Netflow_enabled_intf=1 Live_sessions=0 Session cache max count:71950