topic Re: Netflow Deployment Strategies in Network Security

Netflow Deployment Strategies

abhijith891 — Fri, 21 Feb 2020 16:00:22 GMT

Hi all,

We currently have SNMP configured on our ASAs which are integrated with our SolarWinds I am told to consider deploying Netflow in our environment. So I would like to know what are the advantages of deploying Netflow over SolarWinds(if there are any); and what are the factors/strategies I need to consider if I have to deploy the same.

If someone could guide me on this, I would really appreciate.

Regards,

Abhijit

Re: Netflow Deployment Strategies

Rob Ingram — Tue, 24 Jul 2018 10:08:49 GMT

Hi,
Did you mean what is the advantage of Neflow over SNMP? If so, netflow will provide much more granular information (top talkers, ports, protocols, ip addresses etc) on the type of traffic being sent over the network, whereas SNMP will provide network interface utilisation stats, interface up/down and much more, but will NOT display the information which Netflow can.

Netflow and SNMP rely on Solarwinds (or any other network monitoring solution) to present the information being sent in a format for administrators to understand.

HTH

Re: Netflow Deployment Strategies

abhijith891 — Tue, 24 Jul 2018 10:26:27 GMT

Hi,

Yes sorry I did mean advantages of Netflow over SNMP. Thanks for your quick response, but I have a few additional queries.

1) Is Netflow worth implementing if its a small environment/company?
2) If yes, how do I go about implementing it? Like what are the things I need to consider, what are the ports I need to open?
3) Do I need to remove the SNMP configs? Like will their logs lead to redundant excessive logging if they both coexist?

Regards,

Abhijit

Re: Netflow Deployment Strategies

Bogdan Nita — Tue, 24 Jul 2018 10:56:02 GMT

1) It depends on the environment, but I would say it is usually worth it.
2) You basically need a netflow collector to send the flows to and to configure your network devices to send the traffic to.
3) You do not need to remove, but depending on the environment and setup the info may be redundant or helpful.

You may find the paper useful:

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-netflow/prod_white_paper0900aecd80406232.html

HTH

Bogdan

Re: Netflow Deployment Strategies

Rob Ingram — Tue, 24 Jul 2018 11:45:21 GMT

Hi,

This example of ASA netflow configuration with Solarwinds may be more relevant to your scenario.

HTH