NetFlow

NetFlow allows you to collect IP network traffic statistics for an interface, and then export those statistics for analysis. NetFlow samplers, that sample every packet, are configured per interface. Full NetFlow is supported through the information maintained in the firewall session.

To configure NetFlow:

config system netflow
    set collector-ip <ip>
    set collector-port <port>
    set interface-select-method {auto | sdwan | specify}
    set source-ip <ip>
    set source-ip-interface <name>
    set active-flow-timeout <integer>
    set inactive-flow-timeout <integer>
    set template-tx-timeout <integer>
    set template-tx-counter <integer>
end

The source-ip-interface and source-ip commands are unavailable for NetFlow configurations when ha-direct is enabled. (See config system ha in the CLI Reference guide). The source-ip-interface and source-ip commands are also mutually exclusive; they cannot be used at the same time, but one or the other can be used together with the interface-select-method command

collector-ip <ip>	Collector IPv4 or IPv6 address.
collector-port <port>	NetFlow collector port number (0 - 65535).
interface-select-method {auto | sdwan | specify}	Routing of the NetFlow messages is determined by the selected method. If neither source-ip-interface nor source-ip is configured, then the source address of the message is the IP address of the interface selected by the interface select method. See Local out traffic for details.
source-ip <ip>	Source IPv4 or IPv6 address, for communication with the NetFlow agent.
source-ip-interface <name>	Utilize the IP address of the specified interface as the source when sending out the NetFlow messages. Routing of the messages does not change based on this setting. The source-ip-interface is unavailable for NetFlow configurations when FortiGate is in transparent VDOM mode.
active-flow-timeout <integer>	Timeout to report active flows, in seconds (60 - 3600, default = 1800).
inactive-flow-timeout <integer>	Timeout for periodic report of finished flows, in seconds (10 - 600, default = 15).
template-tx-timeout <integer>	Timeout for periodic template flowset transmission, in seconds (60 - 86400, default = 1800).
template-tx-counter <integer>	Counter of flowset records, before resending a template flowset record (10 - 6000, default = 20).

To configure NetFlow in a specific VDOM:

config vdom
    edit <vdom>
        config system vdom-netflow
            set vdom-netflow enable
            set collector-ip <ip>
            set collector-port <port>
            set source-ip <ip>
        end
    next
end

To configure a NetFlow sampler on an interface:

config system interface
    edit <interface>
        set netflow-sampler {disable | tx | rx | both}
    next
end

disable	Disable the NetFlow protocol on this interface (default).
tx	Monitor transmitted traffic on this interface.
rx	Monitor received traffic on this interface.
both	Monitor transmitted/received traffic on this interface.

To configure a source interface for syslog:

1. Configure the interface:

   config system interface
       edit "loopback"
           set vdom "vdom1"
           set ip 10.10.10.2 255.255.255.0
           set allowaccess ping
           set type loopback
       next
   end

2. Configure the syslog device:

   config log syslogd setting
       set status enable
       set server "172.16.200.55"
       set facility local6
       set source-ip-interface "loopback"
   end

Verification and troubleshooting

If data are not seen on the NetFlow collector after it has been configured, use the following sniffer commands to verify if the FortiGate and the collector are communicating:

• By collector port:

  # diagnose sniffer packet 'port <collector-port>'  6 0 a

• By collector IP address:

  # diagnose sniffer packet 'host <collector-ip>' 6 0 a

NetFlow uses the sflow daemon. The current NetFlow configuration can be viewed using test level 3 or 4:

# diagnose test application sflowd 3

# diagnose test application sflowd 4
Netflow Cache Stats:
vdoms=1 Collectors=1 Cached_intf=2 Netflow_enabled_intf=1 Live_sessions=0 Session cache max count:71950