Ingest NetFlow/sFlow from network devices via direct UDP

Netography Fusion collects flow records from network devices, including routers, switches, firewalls, and any other device that can output NetFlow, sFlow, or IPFIX.

This page documents how to directly point your network devices to send NetFlow or sFlow to your Netography Fusion ingest IP and port. This delivers flow records to Fusion via unencrypted UDP packets.

If you want to deliver NetFlow or sFlow from your network devices via a TLS-encrypted reliable API connection to the Netography Fusion SaaS, see: Ingest NetFlow/sFlow via the NetoFlow Connector.

For more details on NetFlow and sFlow and configuration tips, see: NetFlow and sFlow.

Steps to Ingest NetFlow/sFlow via direct UDP

There are 2 steps involved in this process:

1. Add a new Device traffic source in Fusion.

2. Configure your network devices to export NetFlow or sFlow to your Netography Fusion ingest IP and port.

1. Add a new Device traffic source in Fusion

To start ingesting directly from a network device, in the Fusion Portal, go to Settings, Traffic Sources, and click the Add a Traffic Source button. Select Device from the list of Flow Sources listed on the Add Traffic Source page.

Add flow source from a network device

Add flow source from a network device

Fill out the Add Device configuration form. The Device Name, Sample Rate, and IP Addresses fields are required. All other fields are optional. The BGP configuration on the second screen is only required if you are using BGP in a response policy to do automated blocking and can usually be omitted.

Note the IP address and port displayed on this page on the right-hand side where it says Your Ingest IP. You will need this when configuring your network devices.

Write down your Fusion Ingest IP:port

Now that you have created a device traffic source, you can start sending NetFlow or sFlow to the ingest IP and port for your account. If you did not copy this when adding a device source, the ingest IP:port is available by going to Settings, Overview, and looking at the Ingest IP field on that page.

2. Configure your network devices to send NetFlow to Fusion

You will now configure your network device to send NetFlow to the Ingest IP. Consult your network device documentation for the exact instructions on configuring it to export NetFlow or sFlow.