Subject: [ipfix-info] Small doubt regarding NetFlow's positioning

From: mgprasad <[email-masked]>
Date: Mon, 03 Oct 2005 15:03:13 +0530

Hello all,

I have a small doubt

Say I have my n/w setup as follows

|Firewall Box|     ----->       |Nat|  ------>    |Router Box|    

Where will the NetFlow feature fit in?
Note that Firewall is running in different hardware, Router is a 
separate hardware so also Nat.

Will it be in Router (ingress | egress)? if yes, then NetFlow is going 
to miss filtered packets there by Network user will be unaware of intruders.
Meaning that Netflow will not get info. about the filtered packets.

So as the case with NAT also.

Hope I am right in my question if wrong, please correct me.

Cheers and Thanks
Ganesh

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Paul Aitken <[email-masked]>
Date: Mon, 03 Oct 2005 12:05:37 +0100

Ganesh,

This alias is for discussing the IPFIX-INFO draft. Your netflow question 
should really be sent to cisco :-)

But let me try to answer in terms of IPFIX-INFO.

> separate hardware so also Nat.

Since you have seperate boxes, you would have to run IPFIX exporters on 
each one you're interested in.

> So as the case with NAT also.

If you want to see which flows the firewall blocked, then the firewall 
would have to export flow data including an indication of which flows 
were blocked. That might be done by including a new IPFIX-INFO object 
which describes whether or not the flow passed through, or more 
usefully, indicating why the flow was blocked. Or blocked flows could be 
exported in a different format to flows passing through.

Obviously this has to run on the ingress side of the firewall, because 
the egress side has no information about which flows were blocked. It's 
not so hard to drop the ingress/egress idea and think of it as running 
in the *middle* of the box.

If you want to see flows associated with the NAT box, then again, that 
might be done by an IPFIX enabled box exporting sourceIPv4Address / 
destinationIPv4Address and new IPFIX INFO elements being the post- or 
NAT equivalents. Again, this would need to be on the ingress side or in 
the middle of the box.

And finally, the same story with the router - though since the output of 
the NAT box is the input to the router, there's nothing new to be gained 
by exporting the ingress flow info. So in this case, you may be more 
interested in the egress flows.

> Hope I am right in my question if wrong, please correct me.

Each box you're interested in needs to be IPFIX enabled, and configured 
to export the information you want.

Cheers.
-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

---

From: mgprasad <[email-masked]>
Date: Mon, 03 Oct 2005 16:46:52 +0530

Paul,

Thanks for your explanations :-)
Please convert all the NetFlow words to IPFIX that will solve the alias 
problem :-)

Cheers N Thanx
Ganesh

Paul Aitken wrote:
> Ganesh,
>
> This alias is for discussing the IPFIX-INFO draft. Your netflow 
> question should really be sent to cisco :-)
> Since you have seperate boxes, you would have to run IPFIX exporters 
> on each one you're interested in.
>
>
>> Will it be in Router (ingress | egress)? if yes, then NetFlow is 
>> going to miss filtered packets there by Network user will be unaware 
>> of intruders.
> usefully, indicating why the flow was blocked. Or blocked flows could 
> be exported in a different format to flows passing through.
>
> the egress side has no information about which flows were blocked. 
> It's not so hard to drop the ingress/egress idea and think of it as 
> running in the *middle* of the box.
>
> NAT equivalents. Again, this would need to be on the ingress side or 
> in the middle of the box.
>
> And finally, the same story with the router - though since the output 
> of the NAT box is the input to the router, there's nothing new to be 
> gained by exporting the ingress flow info. So in this case, you may be 
> more interested in the egress flows.
>
>
> Each box you're interested in needs to be IPFIX enabled, and 
> configured to export the information you want.
>
> Cheers.