Netflow

Netflow

NetFlow is a feature developed by Cisco which provides the ability to collect IP network traffic information as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup consists of three main components:

• Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. In this case, the NGFW.
• Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter.
• Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example.

Netflow on NGFW uses softflowd.

Netflow

Netflow settings are located in Config > Network > Advanced > Netflow.

• Netflow enabled
  • This enables the sending of netflow data to the specified netflow collector.
• Host
  • The IP address or hostname of the netflow collector.
• Port
  • The port for the netflow collector.
• Version
  • The version of netflow to send. NGFW supports multiple standard versions: v1, v5, and v9.