Configure NetFlow Settings
Use Pre-defined NetFlow Templates
NetFlow templates provide a mechanism to identify and decode incoming flow data before sending it for further processing within Paragon Insights.
- Click Configuration > Data Ingest > Settings in the left-nav bar.
- Click the NetFlow tab on Ingest Settings page.
- On the NetFlow settings page, review the available templates for use in a rule.
Usage Notes:
-
Notice that there are default flow templates for IPv4, IPv6, MPLS, MPLS-IPv4, MPLS-IPv6, and VPLS, for each of NetFlow v9 and v10.
-
The NetFlow templates include recognition patterns, called include fields and exclude fields, which help to recognize, identify, and categorize the incoming messages.
-
Since NetFlow messages don’t distinguish between keys and values (all fields are simply incoming data), the templates specify which fields should be treated as keys for raw data.
Create Custom NetFlow Templates
If the existing templates do not meet your needs, you can create your own template. You can also use custom templates to support other vendors’ devices.
Usage Notes:
-
Priority - when a playbook includes multiple rules using the flow sensor, the priority value identifies which sensor and template gets priority over the other(s).
-
Include/Exclude fields - include fields to help identify the template to use, or at least a ‘short list’ of templates to use; exclude fields then narrow down to the single desired template.
-
Example 1 - consider the hb-ipfix-ipv4-template template: it includes two IPv4 fields to narrow down to hb-ipfix-ipv4-template and hb-ipfix-mpls-ipv4-template, and excludes an MPLS field to eliminate hb-ipfix-mpls-ipv4-template, leaving only hb-ipfix-ipv4-template.
-
Example 2 - consider the hb-ipfix-mpls-ipv4-template template: it includes the same two IPv4 fields to narrow down to hb-ipfix-ipv4-template and hb-ipfix-mpls-ipv4-template. It also includes an MPLS field, which immediately eliminates the former template and leaving the latter as the template to use.
-
Delete a NetFlow Template
To delete a NetFlow template:
Clone an Existing NetFlow Template
To clone an existing NetFlow template:
Configure Flow Source IP Address
The raw flow data that Paragon Insights receives is in binary format and unreadable. In order to make this data usable, Paragon Insights processes the incoming flow data as follows:
-
Paragon Insights listens for incoming flow data on a configured port
-
Since NetFlow messages don’t include a field that identifies the sending device, Paragon Insights uses the configured source IP address to derive a device ID.
-
Templates identify and decode incoming flow data to determine which fields it contains
The resulting decoded and normalized data is now in a readable and usable format.
-
Paragon Insights then performs further tagging, normalization, and aggregation as defined in the corresponding rule by the user.
-
Finally, the time-series database (TSDB) receives the data. This is where things like trigger evaluation happen.
For NetFlow ingest, ensure that there is no source NAT in the network path(s) between the device and Paragon Insights. If the network path contains source NAT, then the received device information is not accurate.
To configure source IP addresses in Device configuration:
To configure source IP addresses in Device Group configuration:
-
Go to Configuration > Device Groups.
You are taken to the Device Group configuration page.
-
Select a device group you want to configure to send Flow data and click the edit button (pencil icon).
You are taken to the Edit Device Group page.
-
Click the Advanced caret and enter the source IP address(es) in the Flow Ingest Deploy Nodes field.
If you want to enter multiple source IP addresses, separate each one with a comma.
-
Click Save & Deploy.
Configure Flow Ports
To configure Flow ports in Device Groups: