Netflow Deployment Strategies

[abhijith891]

Hi all,

We currently have SNMP configured on our ASAs which are integrated with our SolarWinds  I am told to consider deploying Netflow  in our environment. So I would like to know what are the advantages of deploying Netflow over SolarWinds(if there are any); and what are the factors/strategies I need to consider if I have to deploy the same.

If someone could guide me on this, I would really appreciate.

Regards,

Abhijit

[Rob Ingram]

Hi,
Did you mean what is the advantage of Neflow over SNMP? If so, netflow will provide much more granular information (top talkers, ports, protocols, ip addresses etc) on the type of traffic being sent over the network, whereas SNMP will provide network interface utilisation stats, interface up/down and much more, but will NOT display the information which Netflow can.

Netflow and SNMP rely on Solarwinds (or any other network monitoring solution) to present the information being sent in a format for administrators to understand.

HTH

[abhijith891]

Hi,

Yes sorry I did mean advantages of Netflow over SNMP.  Thanks for your quick response, but I have a few additional queries.

1) Is Netflow worth implementing if its a small environment/company?
2) If yes, how do I go about implementing it? Like what are the things I need to consider, what are the ports I need to open?
3) Do I need to remove the SNMP configs? Like will their logs lead to redundant excessive logging if they both coexist?

Regards,

Abhijit

[Bogdan Nita]

1) It depends on the environment, but I would say it is usually worth it.
2) You basically need a netflow collector to send the flows to and to configure your network devices to send the traffic to.
3) You do not need to remove, but depending on the environment and setup the info may be redundant or helpful.

You may find the paper useful:

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-netflow/prod_white_paper0900aecd80406232.html

HTH

Bogdan

[Rob Ingram]

Hi,

This example of ASA netflow configuration with Solarwinds may be more relevant to your scenario.

HTH