Fortinet FortiGate (FortiOS)v7.0.20

This page covers FortiGate Next-Generation Firewalls running FortiOS (commands verified against FortiOS 6.4 through 8.0). It explains the FortiGate’s limited built-in port-mirroring options and its NetFlow/IPFIX and sFlow export to Netmon.

Mirror traffic (SPAN)

FortiGate port mirroring is only partially supported, and the support depends on how the ports are organized:

• Ports grouped into a FortiGate software switch can mirror to a destination port using config system switch-interface (the span family of options below). This is the only native SPAN-style mirror the FortiGate offers from the CLI.
• Ordinary routed/firewall interfaces are not SPAN sources. A normal FortiGate interface cannot be turned into a span source or destination. To inspect traffic on those interfaces you either configure the FortiGate’s one-arm sniffer (which inspects a copy of traffic that is mirrored to the FortiGate by an external switch) or, on FortiSwitch-managed deployments, use FortiSwitch SPAN/RSPAN/ERSPAN to mirror switch ports out to Netmon.

The practical result: if the ports you want to capture are members of a FortiGate software switch, use the procedure below to echo them to a free physical port cabled to Netmon. Otherwise, mirror at the adjacent switch (see the relevant switch vendor’s page in this guide) and cable that mirror destination to the Netmon sniffer NIC.

Mirror ports on a FortiGate software switch:

1. Enter the software switch interface and enable port spanning.

   config system switch-interface
       edit <switch-name>
           set span enable

2. Set the source port(s) whose traffic you want copied. List one or more physical member interfaces.

   set span-source-port <interface-name1>, <interface-name2>

3. Set the destination port (the free physical port cabled to the Netmon sniffer NIC). All traffic on the source ports is echoed here.

   set span-dest-port <interface-name>

4. Choose which direction(s) to copy, then save. Use both to capture received and transmitted packets.

   set span-direction both
       next
   end

   Valid span-direction values: rx (received only), tx (transmitted only), both (both directions).

Source: FortiOS CLI Reference (config system switch-interface), FortiOS 6.4.0. https://docs.fortinet.com/document/fortigate/6.4.0/cli-reference/7620/system-switch-interface

Export flow data

FortiOS exports flow records two ways: NetFlow, exported in a template-based flowset format (the template-tx-* settings below drive the NetFlow template transmission), and sFlow (sFlow v5). Both are configured with a global collector block plus a per-interface sampler. Point the collector at the Netmon appliance.

NetFlow / IPFIX (UDP 9996)

1. Define the global NetFlow collector. Set the collector IP to the Netmon appliance and the collector port to 9996 (Netmon’s flow listener). Set source-ip to the address Netmon already knows this FortiGate by, so the exporter’s source address matches the device’s identity in Netmon.

   config system netflow
       set active-flow-timeout 1800
       set inactive-flow-timeout 15
       set template-tx-timeout 1800
       set template-tx-counter 20
       config collectors
           edit 1
               set collector-ip <netmon-ip>
               set collector-port 9996
               set source-ip <fortigate-source-ip>
           next
       end
   end

   Defaults from the FortiOS documentation: active-flow-timeout 1800 s (range 60-3600), inactive-flow-timeout 15 s (range 10-600), template-tx-timeout 1800 s (range 60-86400), template-tx-counter 20 (range 10-6000). The template-based transmission is what carries the NetFlow template flowsets to the collector.

2. Enable the NetFlow sampler on each interface whose traffic you want exported. Use both to report transmitted and received traffic.

   config system interface
       edit <interface-name>
           set netflow-sampler both
       next
   end

   Valid netflow-sampler values: disable, tx (transmitted), rx (received), both. Optionally set a sample rate; set netflow-sample-rate 1 (the default) samples every packet, and a higher value samples one packet per N to reduce collector load.

Source: FortiOS Administration Guide (NetFlow), FortiOS 8.0.0. https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/998643/netflow

sFlow (UDP 6343)

1. Define the global sFlow collector. Point it at Netmon on the sFlow port 6343, and set source-ip to the address Netmon knows this FortiGate by.

   config system sflow
       set collector-ip <netmon-ip>
       set collector-port 6343
       set source-ip <fortigate-source-ip>
   end

2. Enable the sFlow sampler on each interface, and set the sample rate, polling interval, and direction.

   config system interface
       edit <interface-name>
           set sflow-sampler enable
           set sample-rate 2000
           set polling-interval 20
           set sample-direction both
       next
   end

   Valid sflow-sampler values: enable, disable. Valid sample-direction values: tx, rx, both. sample-rate 2000 samples one packet in every 2000; polling-interval is the counter-export interval in seconds.

Source: FortiOS Administration Guide (sFlow), FortiOS 8.0.0. https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/505119/sflow