Forward Node Collecting on a SPAN port - VS- Network Flow traffic being forwarded to Security Onion from Network Devices (i.e. Cisco, Palo Alto)

[MACKG17]

Version

2.4.90

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

8

RAM

16

Storage for /

750

Storage for /nsm

750

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

NetFlow Question: If you have a Forward Node deployed collecting network traffic on a SPAN port, is it necessary to forward network flow traffic from Network Devices? Is there a situation where you would want to do both?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

From https://docs.securityonion.net/en/2.4/additional-network.html:

In the Network Visibility section, we looked at network visibility provided by Security Onion itself. The ideal situation would be to have Security Onion network sensors covering each and every one of your network segments. If you’re able to achieve that ideal situation, then you may not need any additional network visibility. However, there may be times when you simply can’t cover certain network segments with Security Onion network sensors and that’s when these additional options can be beneficial. Keep in mind, though, that the data that they provide is nowhere near as comprehensive as a full Security Onion network sensor. One option would be NetFlow logs from firewalls, switches, or routers showing what traffic was observed by the network device.

[MACKG17]

Thanks Doug, this helped. So, I will use my Forward Nodes which is receiving all traffic from my SPAN ports on those network segments as my NetFlow collector, and then on those portions of the network segment that I DO NOT have a SPAN configured to collect on, then I will forward my NetFlow traffic from the network devices. Now should I forward my NetFlow to my Forward Nodes or my Manager Node?

[dougburks]

That's really up to you depending on your network topology, your Security Onion topology, and the resources that you have for your Security Onion nodes to handle the load of the additional netflow traffic.