NetFlow showing impossible flows

[Jesse_Ohlsson]

Good morning, everyone. Last week, I configured one of our FortiGate 100D firewalls to send NetFlow datagrams to my new Management Center server. I began seeing data immediately. However, I'm receiving reports of impossible flows:

I sorted the flows in descending order of TX and RX Bytes in those two images, respectively.

It's just not a possible amount of traffic. This isn't the first time I've encountered these crazy NetFlow statistics with Management Center, though. Last year, at a different organization, I was testing the feasibility of using Management Center to manage a Cisco network (it isn't very feasible, by the way), and I encountered similar impossible flows when I enabled reporting our our Cisco Catalyst 6513.

My evaluation license in Management Center expired before I discovered the source of those impossible flows.

The situation at my organization now is that we have fielded Summit X440 switches at remote locations, which are using FortiGate 100D firewalls as their gateways. From a flow monitoring perspective of network management, it makes sense to collect the flow data from the firewalls (which are capable of NetFlow v9, required by Management Center). The X440 switches are not able to report Netflow, and Management Center is unable to collect sFlow (which the X440 switches can report).

I've asked the Fortinet community about the possibility of filtering the NetFlow datagrams at the source, although their user community seems to be largely a ghost town.

Is it possible for me to ignore these flows at the Management Center? They are making half of the Analytics dashboard useless, by filling panes that sort by bandwidth with noise:

Any dashboard pane that reports TopN of anything by bandwidth shows those impossible flows, masking anything of use to me about our networks.

How to make Management Center report on flows only concerning our networks? Or, how to make it ignore that noise? Those are the problems I need to solve to make NetSight Analytics of any use to us.

[Jeremy_Gibbs]

This also might be a good thread to look at...

https://supportforums.cisco.com/discussion/11141021/deny-hopopt-reverse-path-check-0000-0000-interfa...

[Jesse_Ohlsson]

On the Management Center > Analytics page, there exists a search/filter field, with which to operate on the Flows tab of that page. Contextual help shows a syntax for developing filters for that page:

Enter search criteria to filter table. One or more filters may be entered, separated by semi-colons. For each filter, individual components of that filter are comma separated. Specific flow components must be specified with a key. Keys are not case sensitive.

Supported keys: CLIENT, SERVER, SERVERPORT, PROTO, SENSOR, IF, INIF, OUTIF, APP, APPGROUP, META, LOCATION, DEVFAMILY, USER, PROFILE
*Note: CLIENT/SERVER may be an IP (CIDR Mask Supported) or host, and may contain a port (X.X.X.X:P)
Supported modifiers: duration, size, packets, bps, with a comparator of: >, >=, =, <, or <=
Supported keywords: Include/Exclude (Include is implied)
Fuzzy filters and partial hostnames are supported
*ie "Doe" will return flows w/ hostnames "JonDoe", "JillDoe", etc

Additionally flow metadata can be searched by using a colon as the key-value delimiter.
Example: meta=Content-Type:application/json

Everything is case insensitive.
A Fuzzy filter is a string without a keyword. It can partially match any value in any column. E.g. "Google" would match source or destination host name "www.google.com";, or application names "Google Mail" or "Google News".

Examples (single filter):
1) "client=JonDoe, server=10.20.77.33, snmp" –> SNMP Flows from host JonDoe to 10.20.77.33
2) "JonDoe, SENSOR=10.20.77.33, snmp" –> SNMP Flows from netflow sensor 10.20.77.33 To/From JonDoe
3) "SERVERPORT=161, duration>1000, exclude" –> All flows EXCEPT SNMP(161) flows that lasted more than 1 second
4) "snmp" –> All snmp traffic
5) "10.20.77.33:161" –> flows where server/serverport = 10.20.77.33:161
6) "JonDoe:161" –> snmp flows to or from JonDoe
7) app=DNS –> All flows identified as belonging to the application "DNS"
 app=89 –> All flows identified as belonging to the application whose ID is 89
9) appgroup=Social Networking –> All flows identified as belonging to the application group "Social Networking"
10) user=none,exclude –> All flows with an identified user
11) inif=11002 –> All flows where input interface = 11002
12) meta=snmp–> All flows with metadata containing the text SNMP
13) meta=Content-Type:application/json;> All flows with an application type of JSON

Example (multi filter):
1) "SERVERPORT=161, duration>1000, exclude; CLIENT=JonDoe; CLIENT=JillDoe" –> All flows from JonDoe and JillDoe except SNMP flows lasting more than 1 sec

If the filter fails to find a match, no data is displayed

Does anyone know if this filter syntax can be used in the Administration > Options > NetFlow Collection > Advanced > Flow Collector Filter field?

[EtherMAN]

Before we purchased Solarwinds we used this free sflow collector ... works great just does not create a data base for searches but for top talkers and such it is good... Vhttp://www.inmon.com/products/sFlowTrend.php .. This would give you the layer 2 traffic on the extreme side to compare to what you are getting on the firewall via netflow.

[Jesse_Ohlsson]

I'm collecting sFlow from the Extreme switches using PRTG as the collector. That output patches well what the NetFlow from the firewall reports, if I ignore the impossible flows I mentioned earlier.

[Jeremy_Gibbs]

This is what I use on our edge route.

ip route 10.0.0.0 255.0.0.0 Null0 200

ip route 169.254.0.0 255.255.0.0 Null0

ip route 192.168.0.0 255.255.0.0 Null0 200

ip route 172.16.0.0 255.240.0.0 Null0

You may need to adjust for your network.