Cyberoam

Please refer below to configure the Cyberoam firewall to export NetFlow packets. You must be logged on to the Web Admin Console as an administrator with Read-Write permission for relevant features.

Step 1: Configure NetFlow Collectors

Go to Logs & Reports > Configuration > Netflow and specify Collector Name, IP/Domain and Port, as shown below.

The default port for NetFlow Collector is 9996.

Click Apply to add collectors.

Step 2: Enable Traffic Logging from Firewall Rule

Go to Firewall > Rule > Rule and click the required Rule. Enable Log Firewall Traffic and click OK.

Currently the Cyberoam NetFlow export is version 5 only, and includes field elements that offer all of the traditional TopN (applications, talkers, and conversations) type of reporting. We have seen many of the next generation firewall vendors export unique vendor flow elements in their flow templates. Hopefully, future plans include taking full advantage of the NetFlow/IPFIX protocol to export more of the network intrusion prevention data in their flow exports.