Netflow / IPFIX Support
Support for Netflow (v1, v5, v9) and IPFIX (IP Flow Information Export) is added to FortiSwitch 6.2, and the resulting data will be available to FortiAnalyzer (and FortiView) for new traffic statistics and topology views. Traffic sampling data can be used to show which users or devices behind switches are generating the highest traffic in those networks.
You can now configure Netflow/IPFIX on managed FortiSwitch units on switch controller.
You can configure flow-tracking related parameters by using the default values:
# config switch-controller flow-tracking
(flow-tracking) # get
sample-mode : perimeter
sample-rate : 512
format : netflow9
collector-ip : 0.0.0.0 ------> all-zero IP address implies disabled
collector-port : 0
transport : udp
level : ip
filter : -------> complies with tcpdump/wireshark filter syntax
max-export-pkt-size : 512
timeout-general : 3600
timeout-icmp : 300
timeout-max : 604800
timeout-tcp : 3600
timeout-tcp-fin : 300
timeout-tcp-rst : 120
timeout-udp : 300
aggregates:
Following are the sampling mode options:
- Perimeter sampling: RX sampling enabled on all non-fabric FortiSwitch ports, including access port and FortiLink port, but not the FortiLink ISL port.
- Device-Ingress sampling: RX sampling enabled on all FortiSwitch ports.
- Local sampling: Sampling must be enabled on specific FortiSwitch ports by using
config switch-controller managed-switchandconfig ports.