Kaspersky SD-WAN

Basic NetFlow settings

You can specify basic NetFlow settings in a NetFlow template or on a CPE device. Basic NetFlow settings specified in the NetFlow template are automatically propagated to all CPE devices that use this NetFlow template.

To modify the basic NetFlow settings:

1. Specify basic NetFlow settings in one of the following ways:
   • If you want to edit basic NetFlow settings in a NetFlow template, go to the SD-WAN → NetFlow templates menu section and click the NetFlow template.
   • If you want to edit the basic NetFlow settings on a CPE device, go to the SD-WAN → CPE menu section, click the CPE device, select the NetFlow tab, and select the Override check box.

   Basic NetFlow settings are displayed.

2. In the NetFlow drop-down list, select Enabled. The default value is Disabled.
3. Specify the NetFlow collector:
   1. Under Collectors, click + Add.
   2. Under Host, enter the IPv4 address of the NetFlow collector.
   3. Under Port, enter the port number of the NetFlow collector. Range of values: 1 to 65,535.

   The NetFlow collector is specified and displayed in the Collectors section. You can specify up to four NetFlow collectors or delete a NetFlow collector. To delete a NetFlow collector, click the delete icon next to it.

4. In the Export version drop-down list, select the version of the NetFlow protocol:
   • 1
   • 5
   • 9 (default)
5. In the Tracking level drop-down list, select which traffic packet information the CPE device tracks:
   • ETHER to track the following information:
     • Source and destination IP addresses and ports
     • Source and destination MAC addresses
     • Outer VLAN tag
     • Protocol being used
   • FULL to track the source and destination IP addresses and ports, as well as the protocol being used. Default value.
   • VLAN to track the following information:
     • Source and destination IP addresses and ports
     • Outer VLAN tag
     • Protocol being used
   • PROTO to track the source and destination IP addresses and the protocol being used.
   • IP to track the source and destination IP addresses.
6. In the Maximum flows field, enter the maximum number of traffic flows that the CPE device can simultaneously track. Range of values: 1 to 65,535. Default value: 8192.

   The higher the value, the higher the CPU load on the CPE device.

7. In the Sampling rate field, specify how frequently the CPE device tracks the traffic packet information. For example, if you enter 10, the CPE device tracks information about every tenth packet of traffic. Range of values: 1 to 8192. Default value: 1024.

   The lower the value, the more accurate the information and the higher the CPU load on the CPE device.

8. In the Timeout maximum life (sec.) field, enter the maximum time in seconds for which the CPE device can track traffic flow information. To disable this feature, enter 0. Range of values: 1 to 9999. Default value: 60.
9. In the Hop limit field, enter the maximum number of hops to NetFlow collectors. Range of values: 1 to 255. Default value: 64.
10. If you want the CPE device to track IPv6 traffic, in the Track IPv6 drop-down list, select Enabled. The default value is Disabled.
11. In the upper part of the settings area, click Save to save the settings of the NetFlow template or CPE device.

If you want a CPE device to send information about traffic packets to NetFlow collectors, you must enable the NetFlow protocol on network interfaces. The NetFlow protocol can be enabled when creating or editing the network interface.