Configuring NetFlow for Solarwinds?

[CiscoBrownBelt]

Is it best to configure the interface you want on the router/switch/fw for ip flow ingress and egress? 

Should you configure Netflow to be enabled on all interfaces?

[Muhammad Awais Khan · Accepted solution]

Hi,

It depends upon your objective what you want to achieve. If you are looking to analyze the network traffic on the wan or

 internet uplink then you need to enable Netflow on the egress direction at least on the Edge Router.

If you are looking for the visibility in solarwinds analyzer for your internal LAN traffic, if you want to observe internal network traffic behaviour, any intrusion activity then you should enable Netflow at least on all your core switch interfaces , you can enable ingress only or both.  Further if you have DMZ/internal servers zone then it is also good idea to enable Netflow on the firewall to have visibility for the traffic reaching your DMZ or your internal applications.

[CiscoBrownBelt]

So its best to go ahead and enable it on all active links on the switches and routers if I want to analyze pretty much all internal and external/wan traffic correct? Any possible considerations I may need to be concerned about in regards to network performance simply running Netflow and exporting the data to let's say Solarwinds or Service Manager,etc.?

[Muhammad Awais Khan · Accepted solution]

Hi,

Yes you can safely enable and netflow requires very less overhead as it is sending only Metadata, not the actual data. It consume typically less than 0.5% of actual traffic.

But still if you have concerns about the bandwidth utilization, you can put some traffic shaping to limit the rate for the traffic sent to netflow server. By this, you will be able to monitor also the traffic match to netflow class map.

I personally never face issue in customer LAN enabling Netflow on all the ports of core switches but you can start by enabling some ports and enabling them gradually. 

[CiscoBrownBelt]

Ok awesome info thanks!

Let's say I wanted to limit bandwidth for a particular customer/remote location. Is it best to just configure a bandwidth shaper policy on the applicable edge router interface or whatever is used to connect to the customer? Is there still a need to enter qos traffic shaper configs for that customer at other internal devices in the network that connect to any other servers, resources, or network devices that the customer traffic may be allowed through or is simply limiting th e bandwidth on the connection/pipe used for connecting to the customer good enough?

[Muhammad Awais Khan · Accepted solution]

Hi,

On the appropriate edge Router, you can use traffic shaper  to control or limit the bandwidth. There is no such need to do that on any internal network. Benefit for applying it at the edge that traffic will be policed before it reach to your internal server resources.