NetFlow showing impossible flows

[Jesse_Ohlsson]

Good morning, everyone. Last week, I configured one of our FortiGate 100D firewalls to send NetFlow datagrams to my new Management Center server. I began seeing data immediately. However, I'm receiving reports of impossible flows:

I sorted the flows in descending order of TX and RX Bytes in those two images, respectively.

It's just not a possible amount of traffic. This isn't the first time I've encountered these crazy NetFlow statistics with Management Center, though. Last year, at a different organization, I was testing the feasibility of using Management Center to manage a Cisco network (it isn't very feasible, by the way), and I encountered similar impossible flows when I enabled reporting our our Cisco Catalyst 6513.

My evaluation license in Management Center expired before I discovered the source of those impossible flows.

The situation at my organization now is that we have fielded Summit X440 switches at remote locations, which are using FortiGate 100D firewalls as their gateways. From a flow monitoring perspective of network management, it makes sense to collect the flow data from the firewalls (which are capable of NetFlow v9, required by Management Center). The X440 switches are not able to report Netflow, and Management Center is unable to collect sFlow (which the X440 switches can report).

I've asked the Fortinet community about the possibility of filtering the NetFlow datagrams at the source, although their user community seems to be largely a ghost town.

Is it possible for me to ignore these flows at the Management Center? They are making half of the Analytics dashboard useless, by filling panes that sort by bandwidth with noise:

Any dashboard pane that reports TopN of anything by bandwidth shows those impossible flows, masking anything of use to me about our networks.

How to make Management Center report on flows only concerning our networks? Or, how to make it ignore that noise? Those are the problems I need to solve to make NetSight Analytics of any use to us.

[Jesse_Ohlsson]

Hello, Erik.

I took your advice and captured 10000 NetFlow packets, which bracketed (in time) instances of impossible flows as shown again on the Analytics Dashboard.

None of the source IP addresses, destination IP addresses, or traffic protocols of the impossible flows displayed by the dashboard during the time period of my packet capture exist in the capture file.

I'm getting fairly good at using WireShark, looking for this stuff.

I think it's time to open a case with GTAC to investigate further.

[Erik_Auerswald]

Hi Jesse,

did you try to take a packet capture of the Netflow data sent by the Fortigate, and looked at it using Wireshark?

The definitely impossible flows show neither input nor output interfaces. They do show some regularity. That might hint at some packet format not supported by Extreme Management Center and interpreted incorrectly.

HTH,
Erik

[Jesse_Ohlsson]

I wouldn't think so. Since I enabled Netflow on that fortigate, the collector (Extreme Management Center) has been available.

Even if not, those flows are describing volumes of traffic that wouldn't be possible for thousands of years over the size pipe to which the fortigate is connected. I really think it's a fault in how the Fortigate reported it, but I don't know how to either filter it out, or delete the information about those flows in Management Center.

My post on the Fortinet community remains unread and unanswered.

Here's a peculiar thing, though: The NetFlow sensor on our PRTG server never once reported these fantastic flows from our Fortigate firewalls.

With what I'm struggling is where lies the fault? Is the Fortigate reporting garbage data? If so, I can't figure why PRTG didn't display it, or, why Management Center analytics does display it.

I strongly suspect that Management Center is displaying what's been reported to it, and PRTG is filtering the NetFlow data before displaying it. Just a suspicion, though. I can't figure how PRTG would know what to filter out, and I didn't tell it to do so.

[Jeremy_Gibbs]

Better question, do you have reverse path check enabled on your FG?

[Jesse_Ohlsson]

Jeremy, I learned that Fortinet calls it reverse path forwarding, and it is enabled by default. There exists a command to permit asymmetric routing (set asymroute enable), which is not enabled on this firewall.

This mystery continues.