Configuring Flow Exports on Vyatta Routers
For NetFlow analysis, you need to configure your devices to export flows to Site24x7 On-Premise Poller, which is the NetFlow collector. The On-Premise Poller will be listening to the particular port to receive flows. Learn how to find the port number of your On-Premise Poller.
Follow the steps below to configure NetFlow exports on Vyatta routers:
- Set the NetFlow version.
set system flow-accounting netflow version 9 - To export flows to the Site24x7, provide the IP address (of the machine on which Site24x7 On-Premise Poller is installed) as the flow destination and its listening port.
set system flow-accounting netflow server <NFA server IP> port <Port #>Example: set system flow-accounting netflow server 192.168.0.1 port 9996 - Issue the following command for every interface you want to monitor:
set system flow-accounting interface <interface name>Example: set system flow-accounting interface eth0 - Set the active flow timeout to 1 minute. By default this will already be set to 1 minute or 60 seconds.
set system flow-accounting netflow timeout expiry-interval 60 - Vyatta flow accounting can be resource intensive when statistics are being collected on all received packets. The alternative is to turn on sampling where 1 packet is accounted for every N packets, N being the sampling rate.
set system flow-accounting netflow sampling-rate NExample: set system flow-accounting netflow sampling-rate 500 - Set the other essential Vyatta flow accounting parameters using the follwing commands:
set system flow-accounting netflow engine-id id (id values range between 0 – 255)
set system flow-accounting netflow timeout max-active-life 604800
set system flow-accounting netflow timeout flow-generic 3600
set system flow-accounting netflow timeout tcp-fin 300
set system flow-accounting netflow timeout tcp-generic 3600
set system flow-accounting netflow timeout tcp-rst 120
set system flow-accounting netflow timeout icmp 300
set system flow-accounting netflow timeout udp 300
NetFlow configuration
system {
flow-accounting {
interface <ifname> { // Please apply this on all active interface
netflow {
version 9 # Can use 5 or 9
engine-id <u32> # 0-255
server <Collector IP> {
port 9996 # user configurable
}
timeout {
expiry-interval 60
flow-generic 3600
icmp 300
max-active-life 604800
tcp-fin 300
tcp-generic 3600
tcp-rst 120
udp 300
}
}
}
}
sFlow configuration
system {
flow-accounting {
sflow {
agentid <u32>
server 192.168.1.1 {
port 9996
}
}