Citrix SD-WAN

Multiple Net Flow Collectors

August 31, 2021

Contributed by:

C S

Net Flow Collectors collect IP network traffic as it enters or exits an SD-WAN interface. By analyzing the data provided by Net Flow, you can determine the source and destination of traffic, class of service, and the causes for traffic congestion. Citrix SD-WAN devices can be configured to send basic Net Flow version 5 statistical data to the configured Net Flow collector. Citrix SD-WAN provides Net Flow support for traffic flows that are obscured by the transport reliable protocol. Devices on the WAN edge of the solution lose capability to collect Net Flow records since only the SD-WAN encapsulated UDP packets are displayed. Net Flow is supported on the Citrix SD-WAN Standard and Premium (Enterprise) Edition appliances.

To configure Net Flow Hosts:

Navigate to Configuration > Appliance Settings > Net Flow > Netflow Host Settings page. Click the Enable NetFlow checkbox, and enter the IP Address, and Port numbers for up to three Net flow Hosts, then click Apply Settings to save the changes.

Netflow settings

NetFlow Export

Net Flow data is exported from the management port of the SD-WAN device. On your Net Flow collector tool, the SD-WAN devices are listed as the configured management IP address, if SNMP is not configured. The interfaces are listed as one for incoming and a second for outgoing (Virtual Path traffic).

Netflow export real-time

Netflow traffic analysis

NetFlow Limitations

With Netflow enabled on SD-WAN Standard and Premium Edition appliances, Virtual Path data is streamed to the designated Netflow collectors. One limitation with this is that one cannot differentiate which physical WAN link is being used by SD-WAN, as the solution reports aggregated Virtual Path information (A Virtual Path may comprise of multiple distinct WAN Paths), there is no way to filter the Netflow records for the distinct WAN paths.
TCP control Bits report as N/A which indicates SD-WAN does not follow the internet standard for Netflow exports based on RFC 7011 which has element ID 6 for tcpControlBits (IANA). Without TCP Flags, calculating round trip time (RTT), latency, jitter, and other performance metrics in the flow data is not possible. From the security side, without TCP flags, the Net Flow collector cannot determine if there are FIN, ACK/RST, or SYN scans occurring.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Multiple Net Flow Collectors

August 31, 2021

Contributed by:

C S

August 31, 2021

Contributed by:

C S

Multiple Net Flow Collectors

NetFlow Export

NetFlow Limitations

In this article