---
title: "Setting up Netflow data collection from Routers, Switches and Firewalls"
canonical: "https://thoughtdata.refined.site/space/TUD/55186280/Setting%20up%20Netflow%20data%20collection%20from%20Routers%2C%20Switches%20and%20Firewalls"
format: markdown
---
## Setting up Netflow data collection on various network devices
**Pre-Requisite**: Basic knowledge of Netflow is required to understand this topic and setting up your Netsense to collect netflow data from different network devices. This is typically done by network admins and advanced users in IT network.
Setting up proper Netflow configuration on routers, switches and firewalls is typically done by network administrators in an IT network. Proper Netflow export configuration on routers, switches and firewalls is essential to do Netflow based traffic monitoring in ThoughtData's Enterprise360.
Various versions of Netflow include
- version 5
- version 7
- version 9
- IPFIX
- CFlow
- SFlow,
- JFlow formats.
Netflow export data format can also widely vary across different device vendors/OEMs.
**Note**: *Providing illustrations for Netflow configuration for various versions or vendors or OEMS is out of scope of this documentation. Enterprise360 users are encouraged to read the respective OEM/vendor manuals/guides in performing the right Netflow export configuration on their respective routers, switches and firewalls.*
During the configuration of Netflow export on routers, switches and firewalls. Users need to configure a export destination IP address. Enterprise360 users should provide Netsense Netflow collector's IP as the destination of their intended Netflow data export.The default export port number which has to be configured for
Netsense Netflow collector shall be port number **9992**.
A example illustration of Cisco based V9 netflow export configuration on a typical switch is provided below
Netflow export on Cisco based networking devices typically follow these steps
Create a Netflow flow record in input and output direction.
Create a flow monitor
Associate a flow record to a flow monitor.
Create a netflow export record.
Associate the export destination IP address and port number information in the export record.
Associate the Netflow Flow monitor to specific ports of the router, switch or firewall on which netflow export is required
**Detailed Steps below (applicable only to Cisco switches/routers) - These are generic steps/guidelines and configuration can vary from model to model, check your device OEM technical documentation for further details.**
1. Configure the Input Flow Record
You can create a flow record and add keys to match on and fields to collect in the flow.
`config terminalflow record {NetSensenputRecord}`
`match ipv4 source address`
`match ipv4 destination address`
`match transport source-port`
`match transport destination-port`
`match ipv4 protocol`
`match interface input`
`match ipv4 tos`
`match flow direction`
`collect interface output`
`collect counter bytes long`
`collect counter packets long`
`collect transport tcp flags`
`collect timestamp absolute first`
`collect timestamp absolute last`
2. Configure the Output Flow Record
`flow record {NetSenseOutputRecord}`
`match ipv4 source address`
`match ipv4 destination address`
`match transport source-port`
`match transport destination-port`
`match ipv4 protocol`
`match interface output`
`match ipv4 tos`
`match flow direction`
`collect interface input`
`collect counter bytes long`
`collect counter packets long`
`collect transport tcp flags`
`collect timestamp absolute first`
`collect timestamp absolute last`
3. Configure the Flow Exporter
You can create a flow export to define the export parameters for a flow.
Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor.
Set the destination to the IP address of your Netsense Netflow Collector.
`flow exporter {ExporterName}`
`destination {NetSenseCollectorIP}`
`source {ManagementInterfaceName}`
`transport udp 9992`
`template data timeout 60`
4. Configure the Input and Output Flow Monitor
You can create a flow monitor and associate it with a flow record and a flow exporter.
`flow monitor {NetSenseInputMonitor}`
`exporter {ExporterName}`
`record {NetSenseInputRecord}`
`cache timeout active 60`
`flow monitor {NetSenseOutputMonitor}`
`exporter {ExporterName}`
`record {NetSenseOutputRecord}`
`cache timeout active 60`
4. Enabling Flow on an Interface
Enter global configuration mode on the Cisco Switch, and issue the following commands for each interface on which you want to enable flow:
`interface {InterfaceName}`
`ip flow monitor {NetSenseInputMonitor} input`
`ip flow monitor {NetSenseOutputMonitor} output`
5. Save the configuration
`copy running-config startup-config`
Refer to respective to vendor/OEM guides for more information on how to enable and export Netflow flow records successfully to target the export to ThoughtData's Netsense Netflow collector.
Troubleshooting Netflow data collection on Netsense Netflow Collector.
- If you are successfully exporting Netflow from your router, switch and firewall. On to Netsense Netflow collector you may test your Netflow export by running following command
- tcpdump port 9992.
- If the output off this command shows Netflow packets from your intended Netflow router, switch or firewall from where you have initiated the netflow export. Then you can presume your Netflow export is being properly setup to ThoughtData's Netsense Netflow collector
- If you do not see netflow packets in the above command, you might want to cross check the Netflow configuration on your respective router, switch or firewall until you get the proper Netflow packets in output of the command above
**Detailed Steps below (applicable only to Juniper devices) - These are generic steps/guidelines and configuration can vary from model to model, check your device OEM technical documentation for further details.**
In config prompt/mode on juniper device run
***set forwarding-options sampling family inet output flow-server 192.168.1.158 port 9992 version9 template ipv4-test***
in above example 192.168.1.158 is the IP address of NetSense flow collector export port is UDP 9992
```
run show forwarding options to check the configuration, sample below, you can set multiple flow collector destinations as required, sample example below , run commit to save the configuration
root# show forwarding-options
sampling {
input {
rate 5;
run-length 0;
}
family inet {
output {
flow-inactive-timeout 300;
flow-active-timeout 60;
flow-server 192.168.1.158 {
port 9992;
version9 {
template {
ipv4-test;
}
}
}
flow-server 192.168.1.244 {
port 9992;
version9 {
template {
ipv4-test;
}
}
}
inline-jflow {
source-address 192.168.1.25;
}
}
}
}
[edit]
root# commit
```
**Sample Configurations for Juniper SRX2300 and SRX4300 routers (replace the flow server/netflow collector IP address and source address/juniper device IP accordingly), also change the interface name as required, note that UDP port 9992 should be opened on firewalls in the network**
set services flow-monitoring version-ipfix template ipv4-traffic ipv4-template
set forwarding-options sampling instance FLOW-SAMPLING-1 family inet output flow-server** 192.168.1.158** port 9992
set forwarding-options sampling instance FLOW-SAMPLING-1 family inet output flow-server **192.168.1.158** version-ipfix template ipv4-traffic
set forwarding-options sampling instance FLOW-SAMPLING-1 family inet output inline-jflow source-address **192.168.1.194**
set forwarding-options sampling instance FLOW-SAMPLING-1 input rate 100
set interfaces **ge-0/1/0 **unit 0 family inet sampling input
set interfaces **ge-0/1/0** unit 0 family inet sampling output
show services accounting flow inline-jflow
**Sample Configurations for Juniper MODEL-ACX7100 routers**
set services flow-monitoring version-ipfix template ipv4-traffic ipv4-template
set forwarding-options sampling instance FLOW-SAMPLING-1 family inet output flow-server** 192.168.1.158** port 9992
set forwarding-options sampling instance FLOW-SAMPLING-1 family inet output flow-server **192.168.1.158** version-ipfix template ipv4-traffic
set forwarding-options sampling instance FLOW-SAMPLING-1 family inet output inline-jflow source-address **192.168.1.194**
set forwarding-options sampling instance FLOW-SAMPLING-1 input rate 100
set interfaces **ge-0/1/0 **unit 0 family inet sampling input
set interfaces **ge-0/1/0** unit 0 family inet sampling output
show services accounting flow inline-jflow
set chassis fpc 0 sampling-instance FLOW-SAMPLING-1
show services accounting flow inline-jflow
**Sample configuration for Fortigate Firewall - These are generic steps/guidelines and configuration can vary from model to model, check your device OEM technical documentation for further details.**
config system netflow
config collectors
edit 1
set collector-ip "192.168.1.158"
set collector-port 9992
set source-ip "192.168.1.205"
next
end
end
config system interface
edit "port1"
set vdom "root"
set mode dhcp
set allowaccess ping https ssh snmp http
set type physical
**set netflow-sampler both**
set alias "1.XNet"
set device-identification enable
set lldp-transmission enable
set role lan
set snmp-index 1
next
end
**Sample configuration for Palo Alto Firewall - These are generic steps/guidelines and configuration can vary from model to model, check your device OEM technical documentation for further details.**
Under Device > Server Profiles > Netflow - edit and change the netflow template settings as below
Under Network > Interfaces Choose a interface on which you want to enable netflow and apply netflow template
Under Device > Setup > Services , Click on service route configuration, click customize , choose netflow and setup service , choose netflow template, source interface and address
Commit the Changes