Ingesting Unifi Netflow

[jellyfishingfisher123]

Version

2.4.160

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

6

RAM

24GB

Storage for /

82.8GB

Storage for /nsm

160.3GB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello Community!

This is my first time making a post in this forum and I am new to Security Onion.

I have got the node running flawlessly, however I am running into an issue getting Netflow to work properly. I have a Unifi UCG Ultra gateway exporting Netflow IPFIX on port 2055. I have followed some youtube videos and the official documentation (https://docs.securityonion.net/en/2.4/netflow.html) to a tee, however I am not getting any data in Netflow dashboards.

For testing I ran sudo iptables -I INPUT -p udp --dport 2055 -j ACCEPT and it ingests flows perfectly for a few minutes until it is overwritten. I run sudo iptables --list -n | grep 2055 and returned ACCEPT udp -- 10.27.27.1 0.0.0.0/0 udp dpt:2055, so I know the port is open for my netflow exporter.

I have tried almost everything, reboot, so-checkin, re-install the netflow integration in elastic, played with the firewall settings. I have no idea where to go next in the troubleshooting process. Please provide help.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

If it works when you manually add an iptables rule, then it seems like something is not quite right in the firewall configuration in SOC.

Did you follow all steps in the firewall section at https://docs.securityonion.net/en/2.4/netflow.html#allow-netflow-traffic-through-firewall?

Are you able to share screenshots of what that config looks like?

[dougburks]

Please run the following command to verify that the iptables rule is in place:

sudo iptables -nvL |grep 2055

Assuming it is, then run this command and monitor the output for a few minutes:

while :; do sudo iptables -nvL |grep 2055; sleep 5s; done

Do you the see the first two columns (pkts and bytes) increasing over time indicating that the netflow traffic is being allowed through the host-based firewall?

Is there anything else on the box that could be modifying iptables rules?

Is there anything else on your network that could be interfering with the netflow traffic?

What timezone is your UniFi device set to? Have you tried setting it to UTC to match the time on your Security Onion instance to see if that makes any difference at all?

[jellyfishingfisher123]

I have run the first command with output: 0 0 ACCEPT udp -- * * 10.27.27.1 0.0.0.0/0 udp dpt:2055

The second command output: 0 0 ACCEPT udp -- * * 10.27.27.1 0.0.0.0/0 udp dpt:2055

I get no traffic on that port as pkts and bytes are blank.

I am able to ping from UCG to SO, but I am unable to get results from traceroute.

The box is fully partitioned for SO and no special alterations were made.
There are no intermediate devices or collectors sitting between UCG and SO.
Unifi UCG is set to UTC with 24hr format.

[dougburks]

If the counters are staying at 0, then it would seem that the traffic is not even reaching the box.

You can try running the following command (replacing INTERFACE with the name of the interface that should be receiving the traffic) to see if you get anything:

sudo tcpdump -nnvvi INTERFACE port 2055

[jellyfishingfisher123]

I don't get any traffic from the Unifi Netflow when running this command. I also tried filtering for traffic on 10.27.27.1 and It was blank. For testing purposes I have tried to change to Version 9 of Netflow with no change.

[dougburks]

Sniffing the traffic with tcpdump removes iptables from the equation altogether. This confirms that the traffic is not reaching your Security Onion box at all. If the traffic is not reaching Security Onion, then you will need to look elsewhere on your network to figure out why. I can confirm that ingesting netflow works perfectly fine on my network.