Wanguard 6.2 User Guide
Configuration » Components » Flow Sensor
Configuration » Components » Flow Sensor
Many routers and switches can collect IP traffic statistics and periodically export them as flow records to a
Flow Sensor
. Because the flow protocol already performs pre-aggregation of traffic data, the flow data sent to Flow
Sensor is much smaller than the monitored traffic, and this makes the Flow Sensor a good option for monitoring
remote or high-traffic networks. The advantages and disadvantages of flow-based monitoring are listed on page 8.
For detailed instructions on how to enable NetFlow, sFlow or IPFIX on your network device, consult its
documentation. Appendix 2 from page 105 contains some examples on how to configure NetFlow on a few Cisco IOS,
CatOS, and Juniper devices.
To add a Flow Sensor, click the <+> button from the title bar of the Configuration » Components panel. To
modify an existing Flow Sensor, go to Configuration » Components and click its name.
The
Flow Sensor Configuration
window contains the following fields:
●
Sensor Name
– A short name to help you identify the Flow Sensor.
●
Device Group
– Optional description used within Console to group up components (e.g. by location or
role). It can be used to restrict the access of Guest accounts.
●
Reports Visibility
– Enable if the Flow Sensor should be listed inside Reports » Components.
●
Sensor Server
– The server that runs the Flow Sensor. The configuration of servers is described on page
●
Listener IP:Port
– The IP address (IPv4 or IPv6) of the network interface that receives flow packets, and
the destination port.
●
Repeater IP:Port
– An embedded packet repeater can send all incoming flows to another flow collector
or host. To use this optional feature enter the IP of the other flow collector and a port of your choice.
●
Flow Collector
– When enabled, all flow data is stored in a space-efficient binary format. Flow records
can be queried in Reports » Tools » Flow Collectors.
●
Sensor License
– The license used by the Flow Sensor. Wanguard provides all features; WanSight does
not provide traffic anomaly detection and reaction.
●
Flow Protocol
– The flow protocol used by the flow exporter: NetFlow, IPFIX or sFlow.
●
Flow Exporter IP
– The IP address of the flow exporter (router, switch, probe). Usually, it is the loopback
address of the router. For sFlow exporters, enter the IP that sends flow packets, not the Agent IP.
●
Sampling (1/N)
– Must contain the sampling rate configured on the flow exporter, or 1 when no
sampling rate is configured. For NetFlow v9 and sFlow the value entered here is ignored because the
flow protocol automatically adjusts the sampling rate. To force a particular sampling value, enter it as a
negative value.
●
Flow Timeout (s)
– For flow exporters that maintain the start time of flows, such as Juniper MX, set the
same flow active/inactive timeout value as the one defined in the flow exporter's configuration. The
value must be entered in seconds (s).
- 42 -
Summary of Contents for wanguard 6.2
Page 1: ......
