So the challenge with filtering Netflow for profiling purposes is chance you will not send the critical info needed to classify an endpoint. If newer Netflow code able to filter flows based on specific packet or protocol match, then that would be ideal. Sampled Netflow would certainly increase chance of missing key traffic.
General best practices include:
- Limit Netflow export to specific interfaces where expecting devices of interest. If using to catch anomalous traffic, then look for choke points.
- It is generally better to use a simple flow with minimal key fields like 5-tuple (source/dest ip/port and protocol) to limit the number of individual flow records.
I do cover some of this in original ISE Profiling Design Guide.
@Jeff: The first question before enabling Netflow for profiling is "Is there a specific requirement that only Netflow can address". Unless used to detect very specific types of endpoints or events, its use is typically not recommended due to potential of overrunning event queue.
If Netflow deemed critical for your use case, please reach out to internal Cisco teams for further discussion on how to best address this requirement. If customer requiring this support, please direct request to your local sales team for escalation to internal teams.
/Craig
