Trisul Network Analytics
Developer Zone

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Fortigate Trisul Netflow configuration ======

Trisul can produce deep reports from Fortigate firewalls Netflow feature.

  * Traffic analysis
  * AppID visibility
  * QoS DHCP
  * NAT
  * etc

===== Configuring on Fortigate =====

=== Enable system wide ===

<code shell>
# config system netflow
    set collector-ip <Trisul-IPv4-Address>
    set collector-port <2055>
    set active-flow-timeout 1
    set inactive-flow-timeout 15
    set template-tx-timeout 60
end
</code> 

=== Enable Netflow on the LAN Interface (both tx and rx) ===
 

<code> 
config system interface 
edit <interface name>
set netflow-sampler both 
end
</code>

=== Or Enable Netflow rx on all interfaces ===

<code> 
config system interface 
edit <interface name>
set netflow-sampler rx
end
</code>

<note important>If you enabled set netflow-sampler both on all interfaces this could result in double counting and show increased bandwidth numbers</note>


===== Configuration on Trisul Network Analytics =====

Next, on Trisul perform the following configuration steps

== Netflow configuration file https://www.trisul.org/docs/ref/netflow-config.html ==

source /usr/local/share/trisul-probe/trisbashrc
edit.cfg
(select option 3 to edit Netflow)


Then make the following changes 
  * Set ''MeterAppID'' to TRUE   (to enable AppID)
  * Set ''IgnoreOutCounts'' to TRUE 
  * Set ''MeterTosAsDSCP'' to TRUE 



== Creating metering policies ==

After Trisul has been running for a while, it is time to configure some extra metering policies. Do the following

  * Create a Crosskey counter group called "FlowIntf_bx_QOS"  parent as FlowIntf, crosskey1 as Flow-TOS
  * Create a Crosskey counter group called "FlowIntf_bx_GeoAS" parent FlowIntf, crosskey1 as ASNumber
  * From the Netflow Wizard enable all Trackers 
  * From the Netflow Wizard enable all Utilization alerts

Then restart the trisul probe.

This will be a good starting configuration for a Fortigate environment.


=== References ===


1. Fortigate Netflow https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-Configure-Netflow/ta-p/196080

2. Trisul Network Analytics - Netflow configuration file https://www.trisul.org/docs/ref/netflow-config.html