Ingest NetFlow & sFlow

Netography Fusion collects flow records from network devices, including routers, switches, firewalls, and any other device that can output NetFlow, sFlow, or IPFIX.

There are two methods for ingesting these flow records into Fusion:

1. Directly point your network devices to send NetFlow/sFlow to your Netography Fusion ingest IP and port. This delivers flow records to Fusion via unencrypted UDP packets.

2. Deploy a NetoFlow Connector in your environment and point your network devices to send NetFlow/sFlow to the NetoFlow Connector. The NetoFlow Connector uses TLS over HTTPS, authenticated with a Netography API key, to deliver the flow records to Fusion in a secure, encrypted, and reliable transport.

NetFlow and sFlow

See NetFlow and sFlow for additional details on choosing between NetFlow and sFlow and configuration details for using those formats with your network devices.

Directly ingest NetFlow from your network devices

Add a device traffic source in Fusion

To start ingesting directly from a network device, in the Fusion Portal, go to Settings, Traffic Sources, and click the Add a Traffic Source button. Select Device from the list of Flow Sources listed on the Add Traffic Source page.

Add flow source from a network device

Add flow source from a network device

Fill out the Add Device configuration form. The Device Name, Sample Rate, and IP Addresses fields are required. All other fields are optional. The BGP configuration on the second screen is only required if you are using BGP in a response policy to do automated blocking and can usually be omitted.

Note the IP address and port displayed on this page on the right-hand side where it says Your Ingest IP. You will need this when configuring your network devices.

Write down your Fusion Ingest IP:port

Now that you have created a device traffic source, you can start sending NetFlow or sFlow to the ingest IP and port for your account. If you did not copy this when adding a device source, the ingest IP:port is available by going to Settings, Overview, and looking at the Ingest IP field on that page.

Configure your network devices to send NetFlow to Fusion

You will now configure your network device to send NetFlow to the Ingest IP. Consult your network device documentation for the exact instructions on configuring it to export NetFlow or sFlow.

Fill out the configuration form

You can find more detailed information on our sFlow and NetFlow references.