FastNetMon VyOS sFlow v5 configuration

You can use FastNetMon Advanced with VyOS routing platform. It’s open source platform but you can buy support directly from developers. In this guide we will provide detailed instructions about this process All these instructions were tested with VyOS 1.2.5 LTS.

VyOS offers Netflow and sFlow support in same time. sFlow is more reactive way and more suitable for DDoS detection.

As first step, please login to VyOS over SSH using default login and password: vyos/vyos and then switch to configuration mode:

conf

Then select interfaces to enable sFlow export, we recommend exporting traffic from upstream ports (please replace ports to your specific values):

Then apply some basic configuration options:

set system flow-accounting buffer-size 64
set system flow-accounting disable-imt

Configure sFlow export (please replace 192.168.1.134 by address of server with FastNetMon installed):

set system flow-accounting sflow agent-address auto
set system flow-accounting sflow sampling-rate 100
set system flow-accounting sflow server 192.168.1.134 port 6343

We set sampling rate to 100 for testing, for ports with at least 1G of bandwidth I recommend increasing this value to 1024, for 10G you can use 2048.

After that, apply changes:

save
commit

Confirm correctness of configuration:

show system flow-accounting 
 buffer-size 64
 disable-imt
 interface eth0
 interface eth1
 sflow {
     agent-address auto
     sampling-rate 100
     server 192.168.1.134 {
         port 6343
     }
 }