Ingesting Unifi Netflow

[jellyfishingfisher123]

Version

2.4.160

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

6

RAM

24GB

Storage for /

82.8GB

Storage for /nsm

160.3GB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello Community!

This is my first time making a post in this forum and I am new to Security Onion.

I have got the node running flawlessly, however I am running into an issue getting Netflow to work properly. I have a Unifi UCG Ultra gateway exporting Netflow IPFIX on port 2055. I have followed some youtube videos and the official documentation (https://docs.securityonion.net/en/2.4/netflow.html) to a tee, however I am not getting any data in Netflow dashboards.

For testing I ran sudo iptables -I INPUT -p udp --dport 2055 -j ACCEPT and it ingests flows perfectly for a few minutes until it is overwritten. I run sudo iptables --list -n | grep 2055 and returned ACCEPT udp -- 10.27.27.1 0.0.0.0/0 udp dpt:2055, so I know the port is open for my netflow exporter.

I have tried almost everything, reboot, so-checkin, re-install the netflow integration in elastic, played with the firewall settings. I have no idea where to go next in the troubleshooting process. Please provide help.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.