Filter NetFlow sampling New

Exclusion filters can be applied to NetFlow sampling based on criteria including source and destination IP addresses, source and destinations ports, and IP protocol. This enhances the relevance of collected data, streamlines data management processes, and reduces excess network traffic. Exclusion filters are defined globally, and up to 64 can be configured.

config system netflow
    config exclusion-filters
        edit <id>
            set source-ip <IP_address>
            set destination-ip <IP_address>
            set source-port <port>
            set destination-port <port>
            set protocol <protocol_ID>
        next
    end
end

source-ip <IP_address>	Session source address.
destination-ip <IP_address>	Session destination address.
source-port <port>	Session source port number or range.
destination-port <port>	Session destination port number or range.
protocol <protocol_ID>	Session IP protocol (0 - 255, default = 255, meaning any).

In this example, IPv4-IPv4 and IPv6-IPv4 exclusion filters are configured on a FortiGate that is connected to a NetFlow connector. Packets are sent that hit the filters, then the session lists are checked for the NetFlow flag and the sessions are checked on the collector.

To configure and test the NetFlow exclusion filters:

1. Create NetFlow exclusion filters:

   config system netflow
       set active-flow-timeout 60
       set template-tx-timeout 60
       config exclusion-filters
           edit 44
               set source-ip 10.1.100.41
               set destination-ip 172.16.200.155
           next
           edit 66
               set source-ip 2000:10:1:100::41
               set destination-ip 2000:172:16:200::155
           next
           edit 64
               set source-ip 2000:10:1:100::41
               set destination-ip 65:ff9b::ac10:c837
           next
           edit 46
               set source-ip 10.1.100.41
               set destination-ip 10.1.100.101
           next
       end
       config collectors
           edit 1
               set collector-ip "10.1.100.59"
           next
       end
   end

2. Send packets to generate sessions.

3. Check if the NetFlow flag is attached in the session/session6 list:

   • If there are two IPv4-IPv4 sessions, and only the first one matches filter ID 44:

     # diagnose sys session list
     session info: proto=1 proto_state=00 duration=17 expire=59 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
     origin-shaper=
     reply-shaper=
     per_ip_shaper=
     class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
     state=log may_dirty f00 netflow-origin netflow-reply
     statistic(bytes/packets/allow_err): org=1512/18/1 reply=1512/18/1 tuples=2
     tx speed(Bps/kbps): 84/0 rx speed(Bps/kbps): 84/0
     orgin->sink: org pre->post, reply pre->post dev=8->7/7->8 gwy=0.0.0.0/0.0.0.0
     hook=post dir=org act=snat 10.1.100.41:11165->172.16.200.155:8(172.16.200.6:11165)
     hook=pre dir=reply act=dnat 172.16.200.155:11165->172.16.200.6:0(10.1.100.41:11165)
     misc=0 policy_id=2 pol_uuid_idx=8173 auth_info=0 chk_client_info=0 vd=0
     serial=000032e9 tos=ff/ff app_list=0 app=0 url_cat=0
     rpdb_link_id=00000000 ngfwid=n/a
     npu_state=0x000001 no_offload
     no_ofld_reason:  disabled-by-policy
     
     session info: proto=1 proto_state=00 duration=16 expire=59 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
     origin-shaper=
     reply-shaper=
     per_ip_shaper=
     class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
     state=log may_dirty f00 netflow-origin netflow-reply
     statistic(bytes/packets/allow_err): org=1428/17/1 reply=1428/17/1 tuples=2
     tx speed(Bps/kbps): 86/0 rx speed(Bps/kbps): 86/0
     orgin->sink: org pre->post, reply pre->post dev=8->7/7->8 gwy=0.0.0.0/0.0.0.0
     hook=post dir=org act=snat 10.1.100.41:11166->172.16.200.55:8(172.16.200.6:11166)
     hook=pre dir=reply act=dnat 172.16.200.55:11166->172.16.200.6:0(10.1.100.41:11166)
     misc=0 policy_id=2 pol_uuid_idx=8173 auth_info=0 chk_client_info=0 vd=0
     serial=000032ea tos=ff/ff app_list=0 app=0 url_cat=0
     rpdb_link_id=00000000 ngfwid=n/a
     npu_state=0x000001 no_offload
     no_ofld_reason:  disabled-by-policy
     total session: 2

   • If there are two IPv6-IPv4 (NAT64) sessions, and only the first one matches filter ID 64:

     # diagnose sys session6 list
     session6 info: proto=58 proto_state=00 duration=23 expire=59 timeout=0 refresh_dir=both flags=00000000 sockport=0 socktype=0 use=3
     origin-shaper=
     reply-shaper=
     per_ip_shaper=
     class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/0
     state=log may_dirty netflow-origin netflow-reply
     statistic(bytes/packets/allow_err): org=2392/23/0 reply=2392/23/0 tuples=2
     tx speed(Bps/kbps): 102/0 rx speed(Bps/kbps): 102/0
     orgin->sink: org pre->post, reply pre->post dev=8->43/43->8
     hook=pre dir=org act=dnat 2000:10:1:100::41:11138->65:ff9b::ac10:c837:128(65:ff9b::ac10:c837:11138)
     hook=post dir=reply act=snat 65:ff9b::ac10:c837:11138->2000:10:1:100::41:129(65:ff9b::ac10:c837:11138)
     peer=172.16.201.8:1066->172.16.200.55:8 naf=1
     hook=pre dir=org act=noop 172.16.201.8:1066->172.16.200.55:8(0.0.0.0:0)
     hook=post dir=reply act=noop 172.16.200.55:1066->172.16.201.8:0(0.0.0.0:0)
     misc=0 policy_id=4 pol_uuid_idx=8176 auth_info=0 chk_client_info=0 vd=0
     serial=0000067e tos=ff/ff ips_view=9572 app_list=0 app=0 url_cat=0
     rpdb_link_id=00000000 ngfwid=n/a
     npu_state=0x040001 no_offload
     no_ofld_reason:  disabled-by-policy non-npu-intf
     
     session6 info: proto=58 proto_state=00 duration=25 expire=59 timeout=0 refresh_dir=both flags=00000000 sockport=0 socktype=0 use=3
     origin-shaper=
     reply-shaper=
     per_ip_shaper=
     class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/0
     state=log may_dirty netflow-origin netflow-reply
     statistic(bytes/packets/allow_err): org=2600/25/0 reply=2600/25/0 tuples=2
     tx speed(Bps/kbps): 103/0 rx speed(Bps/kbps): 103/0
     orgin->sink: org pre->post, reply pre->post dev=8->43/43->8
     hook=pre dir=org act=dnat 2000:10:1:100::41:11137->65:ff9b::ac10:c89b:128(65:ff9b::ac10:c89b:11137)
     hook=post dir=reply act=snat 65:ff9b::ac10:c89b:11137->2000:10:1:100::41:129(65:ff9b::ac10:c89b:11137)
     peer=172.16.201.8:1065->172.16.200.155:8 naf=1
     hook=pre dir=org act=noop 172.16.201.8:1065->172.16.200.155:8(0.0.0.0:0)
     hook=post dir=reply act=noop 172.16.200.155:1065->172.16.201.8:0(0.0.0.0:0)
     misc=0 policy_id=4 pol_uuid_idx=8176 auth_info=0 chk_client_info=0 vd=0
     serial=0000067d tos=ff/ff ips_view=9572 app_list=0 app=0 url_cat=0
     rpdb_link_id=00000000 ngfwid=n/a
     npu_state=0x040001 no_offload
     no_ofld_reason:  disabled-by-policy non-npu-intf
     total session6: 2

4. Check on the collector server. The FlowSets are received on collector for the session/session6 if they do not match the filters. If the sessions match the filter in the system NetFlow, then no FlowSets are received on the collector.

   • IPv4-IPv4 FlowSets:

     Do not receive FlowSets that match exclusion filter ID 44:

     

     Receive FlowSets that do not match any exclusion filters:

     

   • IPv6-IPv4 FlowSets:

     Do not receive FlowSets that match exclusion filter ID 64:

     

     Receive FlowSets that do not match any exclusion filters: