Fortinet FortiSwitchv7.0.20

This page covers standalone FortiSwitch units running FortiSwitchOS (CLI examples verified against FortiSwitchOS 7.6.5). It shows how to mirror traffic to Netmon with a SPAN session and how to export flow data using sFlow.

Mirror traffic (SPAN)

FortiSwitchOS supports local SPAN port mirroring. Pick a destination port that is cabled to a Netmon sniffer NIC, then assign the source ports you want to observe.

1. Enter the switch mirror configuration and create a named mirror session in SPAN mode.

   switch # config switch mirror
   switch (mirror) # edit "m1"
   switch (m1) # set mode SPAN

2. Set the destination port (the port connected to the Netmon sniffer NIC). On models that support multiple mirror destinations, configure the destination before the source ports.

   switch (m1) # set dst "<dst-port>"

3. Add the source ports to mirror. Use set src-ingress for received traffic and set src-egress for transmitted traffic. Multiple ports are space-separated.

   switch (m1) # set src-ingress "<src-port-a>" "<src-port-b>"
   switch (m1) # set src-egress "<src-port-c>"

4. Activate the session and commit. Set switching-packet to enable when the destination is also forwarding normal switched traffic; set it to disable when the destination is a dedicated monitor port.

   switch (m1) # set switching-packet disable
   switch (m1) # set status active
   switch (m1) # end

A complete example mirroring ingress on port3/port4 and egress on port2 out to port5:

config switch mirror
    edit "m1"
        set mode SPAN
        set dst "port5"
        set src-egress "port2"
        set src-ingress "port3" "port4"
        set switching-packet enable
        set status active
end

On the Netmon side, set the receiving NIC to Sniffer (manual) so it continuously captures the mirrored traffic. See Receiving the Data in Netmon.

Source: FortiSwitchOS Administration Guide, Version 7.6.5. https://docs.fortinet.com/document/fortiswitch/7.6.5/fortiswitchos-administration-guide/428708/configuring-a-span-mirror

Export flow data

FortiSwitchOS exports sFlow version 5 datagrams. It does not export NetFlow or IPFIX, so use Netmon’s sFlow collector (UDP 6343). Configuration is two parts: define the collector globally, then enable packet sampling on each port you want to monitor.

1. Define the sFlow collector. Set ip to the Netmon appliance’s address and port to Netmon’s sFlow port, 6343.

   switch # config system sflow
   switch (sflow) # config collectors
   switch (collectors) # edit "netmon"
   switch (netmon) # set ip <netmon-ip>
   switch (netmon) # set port 6343
   switch (netmon) # next
   switch (collectors) # end
   switch (sflow) # end

   Note

   The default collector port is 6343, which already matches Netmon. Set it explicitly so the configuration is self-documenting.

2. Enable packet sampling on each monitored port. packet-sample-rate is the sampling denominator (an average of one out of count packets is sampled); the range is 0-99999 and the default is 512. sample-direction selects rx, tx, or both (the default is both). sflow-counter-interval is how often interface counters are sent (1-255 seconds, default 30).

   switch # config switch interface
   switch (interface) # edit "<port>"
   switch (port) # set packet-sampler enabled
   switch (port) # set packet-sample-rate <count>
   switch (port) # set sample-direction both
   switch (port) # set sflow-counter-interval 30
   switch (port) # next
   switch (interface) # end

   Example enabling sampling on port20 at a 1-in-4 rate:

   config switch interface
       edit "port20"
           set packet-sampler enabled
           set packet-sample-rate 4
           set sflow-counter-interval 3
   end

3. Verify the configuration.

   switch # get system sflow

On the Netmon side, enable Allow Netflow Data Collection on the device so the inbound sFlow is accepted. See Receiving the Data in Netmon.

Source: FortiSwitchOS Administration Guide, Version 7.6.5. https://docs.fortinet.com/document/fortiswitch/7.6.5/fortiswitchos-administration-guide/741913/sflow