NetFlow showing impossible flows

[Jesse_Ohlsson]

Good morning, everyone. Last week, I configured one of our FortiGate 100D firewalls to send NetFlow datagrams to my new Management Center server. I began seeing data immediately. However, I'm receiving reports of impossible flows:

I sorted the flows in descending order of TX and RX Bytes in those two images, respectively.

It's just not a possible amount of traffic. This isn't the first time I've encountered these crazy NetFlow statistics with Management Center, though. Last year, at a different organization, I was testing the feasibility of using Management Center to manage a Cisco network (it isn't very feasible, by the way), and I encountered similar impossible flows when I enabled reporting our our Cisco Catalyst 6513.

My evaluation license in Management Center expired before I discovered the source of those impossible flows.

The situation at my organization now is that we have fielded Summit X440 switches at remote locations, which are using FortiGate 100D firewalls as their gateways. From a flow monitoring perspective of network management, it makes sense to collect the flow data from the firewalls (which are capable of NetFlow v9, required by Management Center). The X440 switches are not able to report Netflow, and Management Center is unable to collect sFlow (which the X440 switches can report).

I've asked the Fortinet community about the possibility of filtering the NetFlow datagrams at the source, although their user community seems to be largely a ghost town.

Is it possible for me to ignore these flows at the Management Center? They are making half of the Analytics dashboard useless, by filling panes that sort by bandwidth with noise:

Any dashboard pane that reports TopN of anything by bandwidth shows those impossible flows, masking anything of use to me about our networks.

How to make Management Center report on flows only concerning our networks? Or, how to make it ignore that noise? Those are the problems I need to solve to make NetSight Analytics of any use to us.

[Jesse_Ohlsson]

Jeremy, the clients and servers in those impossibly large flows aren't in any of my networks. What I mean to say here, I think, is that it isn't one of the non-routable networks as you've listed that are the sources of these flows I'm investigating.

[Jesse_Ohlsson]

I'll investigate those null routes, Jeremy.

[Jesse_Ohlsson]

On page 853 of the Extreme Management Center User Guide, is a section called Flow Collector Filter:

Use this field to filter all incoming flows as they are processed by the flow
collector. Flows not matching the filter are discarded and not maintained in
memory on the server. If you add a filter here, the current flows stored in the
cache are trimmed to only matching flows.
Use this option if you want to use flow collection to look for specific results,
and unrelated flows do not need to be processed. For example, only
processing flows pertaining to a particular subnet."

That looks promising, but there's nothing at all in that manual describing the syntax to construct that filter.

[Jeremy_Gibbs]

Try doing some packet captures at the ingress of your network (where the firewall is). Could you make sure you have Null routes black holing everything else that you don't route for?

[Jesse_Ohlsson]

You'd think, Jeremey. But, I'm not routing any of the source or destination addresses of those crazy flows. And, I have no latency or throughput issues with these remote sites. That detracts from the routing loop possibility.

What puzzles me is that I saw this same sort of crazy stuff from that other Cisco router I once configured to send NetFlow to Management Center.

This can't possibly be traffic through my monitored interface. The thing I can't get my mind around is from where is it coming?