Help sending flows to an IPsec destination

sipple31

I have a branch office running a Netgate 7541. Default route over IPsec back to HQ. I want to capture flows and send them back to our Orion server at HQ. I've tried both softflowd and pfflowd with the same results. I do this at some of our other locations with an ASA 5505… so it shouldn't be impossible.

thanks!

jimp

You'll have to nudge the firewall to send the flows from a source of the LAN IP or similar, usually with a static route.

sipple31

I tried a static route without success. Will attach some screenshots. The source ping works fine.

Flow is below:

172.20.10.254 |pfsense| public IP <ipsec>internet <ipsec>|Corporate ASA| 172.20.1.1 <> 172.20.1.68 (Netflow Receiver)

sfd.jpg_thumb

gw.jpg_thumb

route.jpg_thumb </ipsec></ipsec>

sipple31

also tried setting the static route to 0.0.0.0/1 … flows still not making it. I also did a pcap to confirm they are not making it. I feel like I'm missing something simple...... :-\

EDIT: BAH. Nevermind. pfflowd works with the static route in place. I absolutely could not get softflowd to work over IPsec. I'm happy.