topic Netflow in General Topics

Netflow

handiansudianto — Fri, 01 Dec 2023 01:03:30 GMT

Hello

What should i do if in the netflow manager we see conversation from ip public to ip public? My goal is to capture netflow from LAN (internal private ip) to the destination (public ip)?

Re: Netflow

the_rock — Fri, 01 Dec 2023 01:36:28 GMT

Im not really clear what you are trying to do here. Just capture traffic or something else? If its capturing, then you can do something like this -> fw monitor -F "srcIP,srcport,dstIP,dstport,protocol"

example fw monitor -F "1.1.1.1,0,2.2.2.2,4434,0"

Andy

Re: Netflow

handiansudianto — Fri, 01 Dec 2023 01:41:55 GMT

Hello,

What i mean is i have Network Traffic Analyst (NTA) tools from solarwinds to capture all network conversation between the client to to the internet using netflow. I already enable netflow side but when i see on the solarwinds the conversation shown from our public IP as the source to the internet. I just want to know how we can get real client ip (private ip of the client) on the netflow, so we can see conversation traffic of each users.

Re: Netflow

the_rock — Fri, 01 Dec 2023 01:44:58 GMT

Ah, got it! Make sure its configured properly in netflow section of web UI or in clish with something like show netflow command. I can check in my lab tomorrow. If I recall right, there is an option in web UI for netflow to set the correct interface as well.

Andy

Re: Netflow

handiansudianto — Fri, 01 Dec 2023 01:46:06 GMT

Thanks you, i believe i already configure the netflow but seem the netflow capture the traffic after NAT process so the real ip is not showing.

Re: Netflow

the_rock — Fri, 01 Dec 2023 02:17:40 GMT

You can always set manual NAT for it, just make sure you are not nattimg that host behind the fw, otherwise, it will show public IP.

Andy

Re: Netflow

Chris_Atkinson — Fri, 01 Dec 2023 03:03:06 GMT

For awareness: