Product Documentation

Multiple Net Flow Collectors

Net Flow Collectors provide the ability to collect IP network traffic as it enters or exits an SD-WAN interface. By analyzing the data provided by Net Flow, you can determine the source and destination of traffic, class of service, and the causes for traffic congestion. NetScaler SD-WAN devices can be configured to send basic NetFlow version 5 statistical data to the configured NetFlow collector.  NetScaler SD-WAN provides NetFlow support for traffic flows that are obscured by the transport reliable protocol.  Devices on the WAN edge of the solution lose capability to collect NetFlow records since they will only see the SD-WAN encapsulated UDP packets. NetFlow is supported on the NetScaler SD-WAN Standard and Enterprise Edition appliances.

To configure Net Flow Hosts:

     1.  Navigate to Configuration > Appliance Settings > Net Flow > Netflow Host Settings page. Click  the  Enable  Netflow checkbox,  and  enter  the  IP  Address, and  Port  numbers  for  up  to  three  Net flow  Hosts,  then click  Apply  Settings to  save  the  changes.

localized image

NetFlow Export

Netflow data is exported from the management port of the SD-WAN device.  On your NetFlow collector tool, the SD-WAN devices will be listed as the configured management IP address, if SNMP is not configured. The interfaces will be listed as one for incoming and a second for outgoing (Virtual Path traffic).

localized image

localized image

NetFlow Limitations

  • With NetFlow enabled on SD-WAN Standard and Enterprise Edition appliances, Virtual Path data is streamed to the designated NetFlow collectors.  One limitation with this is that one cannot differentiate which physical WAN link is being used by SD-WAN, as the solution reports aggregated Virtual Path information (A Virtual Path may comprise of multiple distinct WAN Paths), there is no way to filter the NetFlow records for the distinct WAN paths.

  • TCP ontrol Bits report as N/A which indicates SD-WAN does not follow the internet standard for NetFlow exports based on RFC 7011 which has element ID 6 for tcpControlBits (IANA).  Without TCP Flags, calculating route trip time (RTT), latency, jitter, and other performance metrics in the flow data will not be possible.  From the security side, without TCP flags, the NetFlow collector cannot determine if there are FIN, ACK/RST, or SYN scans occurring.

Multiple Net Flow Collectors