FortiGate - Netflow Configuration

Problem

Internally, a SIEM solution or similar is operated and therefore all traffic coming in and out of the Internet should be sent to the logging solution.

Solution

About Netflow

NetFlow allows you to collect IP network traffic statistics for an interface, and then export those statistics for analysis. NetFlow samplers, that sample every packet, are configured per interface. Full NetFlow is supported through the information maintained in the firewall session.

Configuration

The configuration differs whether VDOMs are active on the FortiGate unit or not.

Without VDOM

Netflow can only be configured via the CLI and consists of two parts.

First, the receiver of the data must be configured globally:

config system netflow
  set collector-ip 192.168.80.3
  set collector-port 2055
  set source-ip 192.168.80.254
end

• collector-ip: IP address of the recipient (of the SIEM solution)
• collector-port: Receiver UDP port (optional ; default udp/2055)
• source-ip: IP of the interface from which the traffic should be sent (optional)

The second step is to activate Netflow on the desired interfaces:

config system interface
  edit wan
    set netflow-sampler { disable | tx | rx | both }
  next
end

• disable: Netflow is disabled on this device
• tx: Send outgoing traffic to Netflow receiver
• rx: Send incoming traffic to Netflow receiver
• both: send all traffic to Netflow receiver

With VDOM

When VDOMs are enabled, the configuration differs slightly.

Also Netflow has to be configured on VDOM level first:

config vdom
  set vdom Internet
    config system vdom-netflow
      set collector-ip 192.168.80.3
      set collector-port 2055
      set source-ip 192.168.80.254
    end
  next
end

HINT: If you want, you can define Netflow in the global space to define it for all VDOMs (see section "Without VDOM").

The second step is to activate Netflow on the desired interfaces:

config system interface
  edit wan
    set netflow-sampler { disable | tx | rx | both }
  next
end

• disable: Netflow is disabled on this device
• tx: Send outgoing traffic to Netflow receiver
• rx: Send incoming traffic to Netflow receiver
• both: send all traffic to Netflow receiver

Verify

Check with the diagnose sniffer tool the traffic from the FortiGate to the Netflow receiver:

diagnose sniffer paket any 'port 2055' 4 0 a

Troubleshooting

You can check the logs from the Netflow Daemon with the following command:

diagnose debug enable
diagnose test application sflowd 3
diagnose test application sflowd 4