Netflow

[handiansudianto]

Hello

What should i do if in the netflow manager we see conversation from ip public to ip public? My goal is to capture netflow from LAN (internal private ip) to the destination (public ip)?

[the_rock]

Im not really clear what you are trying to do here. Just capture traffic or something else? If its capturing, then you can do something like this -> fw monitor -F "srcIP,srcport,dstIP,dstport,protocol"

example  fw monitor -F "1.1.1.1,0,2.2.2.2,4434,0"

Andy

[handiansudianto]

Hello,

What i mean is i have Network Traffic Analyst (NTA) tools from solarwinds to capture all network conversation between the client to to the internet using netflow. I already enable netflow side but when i see on the solarwinds the conversation shown from our public IP as the source to the internet. I just want to know how we can get real client ip (private ip of the client) on the netflow, so we can see conversation traffic of each users.

[the_rock]

Ah, got it! Make sure its configured properly in netflow section of web UI or in clish with something like show netflow command. I can check in my lab tomorrow. If I recall right, there is an option in web UI for netflow to set the correct interface as well.

Andy

[handiansudianto]

Thanks you, i believe i already configure the netflow but seem the netflow capture the traffic after NAT process so the real ip is not showing.

[the_rock]

You can always set manual NAT for it, just make sure you are not nattimg that host behind the fw, otherwise, it will show public IP.

Andy

[Chris_Atkinson]

For awareness: