Help sending flows to an IPsec destination


  • I have a branch office running a Netgate 7541.  Default route over IPsec back to HQ.  I want to capture flows and send them back to our Orion server at HQ.  I've tried both softflowd and pfflowd with the same results.  I do this at some of our other locations with an ASA 5505… so it shouldn't be impossible.

    thanks!

  • Rebel Alliance Developer Netgate

    You'll have to nudge the firewall to send the flows from a source of the LAN IP or similar, usually with a static route.


  • I tried a static route without success.  Will attach some screenshots.  The source ping works fine.

    Flow is below:

    172.20.10.254 |pfsense| public IP <ipsec>internet <ipsec>|Corporate ASA| 172.20.1.1 <> 172.20.1.68 (Netflow Receiver)






    </ipsec></ipsec>


  • also tried setting the static route to 0.0.0.0/1 … flows still not making it.  I also did a pcap to confirm they are not making it.  I feel like I'm missing something simple......  :-\

    EDIT: BAH. Nevermind. pfflowd works with the static route in place. I absolutely could not get softflowd to work over IPsec. I'm happy.