Softflowd source interface
-
Hi guys,
Simple question, hopefully simple answer. Is there a way to change the source interface where softflowd sends it's collected information from?
Softflowd now uses the closest interface to the NetFlow collector destination.It would be nice to originate softflowd from an specific interface.
Thanks in advance!
-
So why would you not want to send it using the interface that is on the network the collector is on? If it doesn't have an interface in the network your collector is on, I would assume it would use the interface with the best route to that. If no specific routing then send it out the default..
-
I am collecting the information from the WAN interface and sending it to an monitoring server on a different subnet trough a site-2-site vpn connection.
The pfsense-box1 is being monitored on MGMT IP 10.1.1.1 for example, the monitoring server uses this IP to collect SNMP data and receives syslog from 10.1.1.1.
The monitorinserver then receives softflowd data from interface 10.2.1.1 on pfsense-box1, because of the IP used on the site-2-site interface.If I can set an source IP where NetFlow data originates, the monitoringserver understands that the Netflow-data is from pfsense-box1,
and not from an different device using 10.2.1.1. I would like to keep using the MGMT IP for everything.
Also from an ACL point of view this is better. Same as you would set an source interface for NTP updates. -
Just to be (hopefully) clear,
softflowd/pfsense uses the routing table to determine which route is best/closest to the given destination. So, in this case, to the monitoring server on a different subnet.
Then softflowd/pfsense determined that it needs to take interface OPT4 (site2site vpn) interface to route traffic to that subnet.
Softflowd then originates traffic from the IP of that OPT4 interface (10.2.1.1)This way the monitoring server sees this NetFlow data from host 10.2.1.1 that is an unknown source, instead of 10.1.1.1 a.k.a. pfsense-Box1.
If I can simply say, bind origin to the LAN interface (10.1.1.1) the monitoring server knows its from pfsense-Box1.Managing and monitoring devices on 1 MGMT IP is a must. I cannot image I'm the only one needing this function.
Look at SNMP and syslog buildin to pfsense. These packages ask witch interface to bind to, or what the source interface is.It would be nice to have the same setting for softflowd/Netfow.
Some hacks of configs are also welcome, but it should be an build-in option of the package in my opinion.
Thanks again. -
It does not look like a bind interface option is present in the softflowd daemon itself, so it is not in the package either.
