Good morning, everyone. Last week, I configured one of our FortiGate 100D firewalls to send NetFlow datagrams to my new Management Center server. I began seeing data immediately. However, I'm receiving reports of impossible flows:
I sorted the flows in descending order of TX and RX Bytes in those two images, respectively.
It's just not a possible amount of traffic. This isn't the first time I've encountered these crazy NetFlow statistics with Management Center, though. Last year, at a different organization, I was testing the feasibility of using Management Center to manage a Cisco network (it isn't very feasible, by the way), and I encountered similar impossible flows when I enabled reporting our our Cisco Catalyst 6513.
My evaluation license in Management Center expired before I discovered the source of those impossible flows.
The situation at my organization now is that we have fielded Summit X440 switches at remote locations, which are using FortiGate 100D firewalls as their gateways. From a flow monitoring perspective of network management, it makes sense to collect the flow data from the firewalls (which are capable of NetFlow v9, required by Management Center). The X440 switches are not able to report Netflow, and Management Center is unable to collect sFlow (which the X440 switches can report).
I've asked the Fortinet community about the possibility of filtering the NetFlow datagrams at the source, although their user community seems to be largely a ghost town.
Is it possible for me to ignore these flows at the Management Center? They are making half of the Analytics dashboard useless, by filling panes that sort by bandwidth with noise:
Any dashboard pane that reports TopN of anything by bandwidth shows those impossible flows, masking anything of use to me about our networks.
How to make Management Center report on flows only concerning our networks? Or, how to make it ignore that noise? Those are the problems I need to solve to make NetSight Analytics of any use to us.
I sorted the flows in descending order of TX and RX Bytes in those two images, respectively.
It's just not a possible amount of traffic. This isn't the first time I've encountered these crazy NetFlow statistics with Management Center, though. Last year, at a different organization, I was testing the feasibility of using Management Center to manage a Cisco network (it isn't very feasible, by the way), and I encountered similar impossible flows when I enabled reporting our our Cisco Catalyst 6513.
My evaluation license in Management Center expired before I discovered the source of those impossible flows.
The situation at my organization now is that we have fielded Summit X440 switches at remote locations, which are using FortiGate 100D firewalls as their gateways. From a flow monitoring perspective of network management, it makes sense to collect the flow data from the firewalls (which are capable of NetFlow v9, required by Management Center). The X440 switches are not able to report Netflow, and Management Center is unable to collect sFlow (which the X440 switches can report).
I've asked the Fortinet community about the possibility of filtering the NetFlow datagrams at the source, although their user community seems to be largely a ghost town.
Is it possible for me to ignore these flows at the Management Center? They are making half of the Analytics dashboard useless, by filling panes that sort by bandwidth with noise:
Any dashboard pane that reports TopN of anything by bandwidth shows those impossible flows, masking anything of use to me about our networks.
How to make Management Center report on flows only concerning our networks? Or, how to make it ignore that noise? Those are the problems I need to solve to make NetSight Analytics of any use to us.
