13.6. Netflow Configuration Wizard

This configuration wizard pulls together various configuration options into one place.

  1. Used to configure most common settings for Netflow
  2. Use SNMP to resolve router names, interface names, and speeds
  3. Enable Interface Tracking
  4. Configure Email Alerts – typically used for interface level Threshold Crossing Alerts

13.6.1 Using the Wizard

Login as admin, then select Context: Default → profile0 → then Netflow Wizard
You will see an Check mark against each option that is configured correctly

Showing Netflow Wizard for the Default context

Notice the wizard has 4 Tabs.

  1. Basics — essential setup for Netflow
  2. Configure Routers — Helps discover router names using SNMP (Optional)
  3. Interfaces — Enable or Disable “Interface Tracking” analytics
  4. Configure Email Alerting — Alerts via Email

13.6.2 Basic configuration

Here you can configure the most common items related to Netflow.

The current setting is shown just below the form items.

Interface to listen on If you are receiving Netflow on an interface other than eth – click on Set Adapter and enter the new interface name.
Specify Home network Enter IP ranges other than the default Private IP space that constitute your home network. This is used for calculating various metrics.
Select Netflow/SFlow ports Enter the UDP ports that are mapped to Netflow. If you want to enter a new port click on Set Netflow Ports then enter a Port Number and select “Netflow” from the drop down list.
Select counter groups for Netflow In Netflow mode many packet based counter groups such as HTTP Hosts, DNS Counters, SSL/TLS certificate metrics are not available. Select Choose Counters then scroll to the bottom for Advanced Options then select Typical enterprise Netflow counter configuration
Switch Trisul Probes to NETFLOW_TAP The Probe nodes have to be in NETFLOW_TAP mode. Click the button and ensure that the Packets or Netflow parameter is changed to NETFLOW_TAP from TAP.

13.6.3 Routers

After Trisul has been collecting Netflow for a while, it automatically builds a map of Routers and their attached Interfaces. This page allows you to perform the following tasks on the discovered routers.

NOTE Skip this step if you have just started collecting Netflow. You can come back here after Trisul has been running for a few hours in Netflow mode.

Select routers and then :

SNMP Settings Read community string for discovery
Resolve Router Names Using SNMP sysName
Resolve Interface Names Using SNMP resolve all the interface names
Resolve Interface Alias Use IF-MIB alias to assign names to discovered router interfaces

13.6.4 Interfaces

This tab allows you to enable the “Interface Tracking” features for discovered interfaces.

NOTE
This step needs to have discovered Netflow entities. Skip this step if you have just started collecting Netflow a few minutes ago. You can come back here after Trisul has been running for a 15-20 minutes.

Select interfaces and then :

Enable Interface Tracking for Top 100 Enables the Interface Tracking feature for the busiest 100 interfaces
Enable Interface Tracking Enables Interface Tracking on the selected intefaces
Disable Interface Tracking Disables the feature

13.6.5 Configure Email alerts

This page allows you to configure real time E-Mail alerts for various conditions.

Account settings Outgoing SMTP email account
Recipients Email IDs of those who want to receive the alerts
Notification Service Must be started and running
Alerts to syslog Select which alert types go to SYSLOG. Trisul sends out Emails only for those alerts that are sent to SYSLOG. To send an alert type to SYSLOG, click on the button and select any SYSLOG alert level in the next screen.
Syslog readable Checks if syslog files on the hub node are readable

Once you go through the items in this wizard you will have a robust Netflow based monitoring system.