topic Not getting netflow through the firewall in Network Security

Not getting netflow through the firewall

sutharhemant90 — Tue, 12 Mar 2019 02:54:07 GMT

Dear All,

From last few days i am trying to get the netflow logs from the router to my system but its not happening. here is one firewall cyberoam between router and system. can anyone tell me what exact port numbers need to be open on the firewall to get the logs.

Quick responce will be appreciated.

Not getting netflow through the firewall

sutharhemant90 — Mon, 21 Oct 2013 14:58:07 GMT

I am using Solarwind and trying to get the logs on port number 2055 and 9666.

Router-------Firewall--------System

Re: Not getting netflow through the firewall

sutharhemant90 — Mon, 21 Oct 2013 15:01:13 GMT

I have asked firewall team to open the port number 2055 and 9666 to my system and for bidirectional to SNMP (TCP 161,162). But still i am not getting.

Re: Not getting netflow through the firewall

johnlloyd_13 — Tue, 22 Oct 2013 07:03:09 GMT

hi,

could you post netflow config from your router?

is router at least able to ping the system/NMS?

Not getting netflow through the firewall

sutharhemant90 — Tue, 22 Oct 2013 07:43:20 GMT

No router is not able to ping my server becoz firewall team has allowed netflow ports on the firewall not ICMP.

interface FastEthernet0/0

ip address 10.10.10.1 255.255.255.0

ip flow ingress

ip route-cache flow input

ip flow-export source FastEthernet0/0

ip flow-export version 5

ip flow-export destination 10.10.10.50 2055

ip flow-export destination 10.10.10.50 9666

Should i allow ICMP from router to my server ?

Not getting netflow through the firewall

johnlloyd_13 — Tue, 22 Oct 2013 08:31:19 GMT

hi,

yes, just for troubleshooting purpose. you can ask your FW team to block it again afterwards.

i just want to ensure your router knows how to get to your NMS.

could you do below and post a show ip flow export?

ip cef

interface FastEthernet0/0

no ip route-cache flow input

ip route-cache flow

no ip route-cache cef

Not getting netflow through the firewall

sutharhemant90 — Tue, 22 Oct 2013 11:24:34 GMT

Please not if my firewall team allow access "any to any" than we are getting the netflow logs.

They need the exact port number and they are even not ready to do the troubleshooting with us. that is the biggest issue for us.

Re: Not getting netflow through the firewall

johnlloyd_13 — Tue, 22 Oct 2013 11:50:25 GMT

Hi,

Did your FW team opened "UDP" ports for 161, 162, 2055 and 9666?

Sent from Cisco Technical Support iPhone App

Not getting netflow through the firewall

sutharhemant90 — Tue, 22 Oct 2013 13:55:40 GMT

Yes, they have opened the port as mentioned below.

2055 & 9666 ( Source router LAN interface and destiona My server)

161 & 162 ( SNMP - Bidirection)

Re: Not getting netflow through the firewall

Don Jacob — Thu, 24 Oct 2013 08:25:24 GMT

I have encountered these kind of issues frequently - it most usually is a case of ACLs either on the firewall or on the router itself.

If any-any allows packets to reach NTA and specific port opening does not, then your firewall team seems to be doing it wrong. Did they make sure they opened UDP 2055 and UDP 9996? And source is FastEthernet0/0 and destination is your NTA server?

Regards,
Don Thomas Jacob
http://www.solarwinds.com/netflow-traffic-analyzer.aspx

NOTE: Please rate and close questions if you found any of the answers helpful.

Not getting netflow through the firewall

sutharhemant90 — Thu, 24 Oct 2013 10:34:32 GMT

Thaks a lot Mr. johnlloyd_13 & Mr. Don. Now the issue has been resolved. Port number was not correctly open in the firewall.