NTA – Configuring NetFlow or sFlow on Network Devices

13 posts

Enable Netflow on Palo Alto

Reading Time: 2 minutes All Palo Alto Networks firewalls support NetFlow (Version 9) except the PA-4000 Series and PA-7000 Series firewalls. The firewalls support only unidirectional NetFlow, not bidirectional. The firewalls perform NetFlow processing on all IP packets on the interfaces and do not support sampled NetFlow. You can export NetFlow records for Layer 3, Layer 2, virtual wire, […]

Configuration Considerations

Reading Time: 2 minutes The sampling rate is a fraction in the form 1/N, meaning that, on average, one out of every N packets will be sampled. The sFlow sample command at the global level or port level specifies N, the denominator of the fraction. Thus a higher number for the denominator means a lower sampling rate since fewer […]

Changing the Sampling Rate

Reading Time: < 1 minute The sampling rate is the average ratio of the number of packets incoming on an sFlow-enabled port, to the number of flow samples taken from those packets. You can change the default (global) sampling rate. You also can change the rate on an individual port, overriding the default sampling rate of 512. With a sampling […]

Changing the Polling Interval

Reading Time: 2 minutes The polling interval defines how often sFlow byte and packet counter data for a port are sent to the sFlow collector(s). If multiple ports are enabled for sFlow, the switch device staggers transmission of the counter data to smooth performance. For example, if sFlow is enabled on two ports and the polling interval is 20 […]

Enable sFlow on FortiGate

Reading Time: < 1 minute Recent FortiOS release adds sFlow support to Fortinet’s FortiGate® appliances. The following commands configure a FortiGate to sample packets at 1-in-10, poll counters every 20 seconds, and send sFlow to an analyzer ( over UDP using the default sFlow port (6343) : config system sflow set collector-ip set collector-port 6343 end Then for each […]