Netflow sampling New

Netflow sampling counts the number of packets or bytes an interface has sampled. If the packet count for a session surpasses the configured threshold for transmitted or received traffic on a NetFlow-enabled interface, a NetFlow report is exported. This helps reduce the load on the collector.

config system interface
    edit <name>
        set netflow-sampler {tx | rx | both}
        set netflow-sample-rate <integer>
        set netflow-sampler-id <integer>
    next
end

netflow-sampler {tx | rx | both}	Enable/disable NetFlow on this interface and set the data that NetFlow collects.
netflow-sample-rate <integer>	NetFlow sample rate. Sample one packet every configured number of packets (1 - 65535, default = 1, which means standard NetFlow where all packets are sampled).
netflow-sampler-id <integer>	NetFlow sampler ID.

All sessions that hit the interface with NetFlow sampling configured are still reported to the exporter daemon (sflowd), which keeps a tally of the sampled packets and bytes. If the session has more ingress, egress, or both, packets than the configured threshold (netflow-sample-rate), then a NetFlow report is exported. The Netflow report includes rounded-up numbers of packets and bytes divided by the sampling rate.

In this example, FortiGate is connect on port2 to a NetFlow collector, NetFlow sampling is configured on port2 with a sampling rate of 100. It is assumed that policies are already configured. Packets are sent that hit the policy. If the number of packets is less than the sampling, then no flowset is sent to the collector. If the number of packets is more than the sampling rate, then a flowset is sent to the collector.

To configure the interface and test sending different numbers of packets:

1. Connect the FortiGate port2 interface to the NetFlow collector.

2. Configure the interface:

   config system interface
       edit "port2"
           set vdom "root"
           set ip 10.1.100.6 255.255.255.0
           set allowaccess https ssh snmp http telnet
           set type physical
           set netflow-sampler both
           set netflow-sample-rate 100
           set netflow-sampler-id 99
           set alias "To_vlan20"
           set snmp-index 2
           config ipv6
               set ip6-address 2000:10:1:100::6/64
               set ip6-allowaccess https ssh http telnet
           end
           set speed 1000auto
       next
   end

3. Send 80 ICMP packets to pass through port2.

   Because this is less than the sample rate of 100, the FortiGate does not send any flowsets to the collector after the session timeout.

   # diagnose sys session list
   
   session info: proto=1 proto_state=00 duration=114 expire=26 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=log may_dirty f00 netflow-origin netflow-reply
   statistic(bytes/packets/allow_err): org=6720/80/1 reply=6720/80/1 tuples=2
   tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
   orgin->sink: org pre->post, reply pre->post dev=8->7/7->8 gwy=0.0.0.0/0.0.0.0
   hook=post dir=org act=snat 10.1.100.41:20043->172.16.200.155:8(172.16.200.6:20043)
   hook=pre dir=reply act=dnat 172.16.200.155:20043->172.16.200.6:0(10.1.100.41:20043)
   misc=0 policy_id=44 pol_uuid_idx=8183 auth_info=0 chk_client_info=0 vd=0
   serial=0001e4be tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x000001 no_offload
   no_ofld_reason:  disabled-by-policy
   total session: 1

4. Send 105 ICMP packets to pass through port2.

   Because this is more than the sample rate of 100, the FortiGate sends one flowset packet to the collector after the session timeout.

   # diagnose sys session list
   
   session info: proto=1 proto_state=00 duration=110 expire=55 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=log may_dirty f00 netflow-origin netflow-reply
   statistic(bytes/packets/allow_err): org=8820/105/1 reply=8820/105/1 tuples=2
   tx speed(Bps/kbps): 78/0 rx speed(Bps/kbps): 78/0
   orgin->sink: org pre->post, reply pre->post dev=8->7/7->8 gwy=0.0.0.0/0.0.0.0
   hook=post dir=org act=snat 10.1.100.41:20072->172.16.200.155:8(172.16.200.6:20072)
   hook=pre dir=reply act=dnat 172.16.200.155:20072->172.16.200.6:0(10.1.100.41:20072)
   misc=0 policy_id=44 pol_uuid_idx=8183 auth_info=0 chk_client_info=0 vd=0
   serial=0001e56f tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x000001 no_offload
   no_ofld_reason:  disabled-by-policy
   total session: 1

5. Check the flowset:

   Octets: 88
   Post Octets: 88
   Packets: 1
   Post Packets: 1
   ......
   SamplerID: 99
   Srcaddr: 10.1.100.41
   Dstaddr: 172.16.200.155
   ......

   Because the sample rate is 100, the flowset means:

   • 88 * 100 = 8800 Bytes

   • 1 * 100 = 100 Packets

   This is basically equal to the actual value of 8820 bytes / 105 packets. This shows that after configuring the NetFlow sampling rate, the received flowsets have been reduced, and the flowsets' values are consistent with the actual values, although not exactly the same.