Create a VA Collector

To add a VA Collector, go to the Lumu Portal and navigate to the Collectors > Virtual Appliance menu, click on the VA in which you want to add the collector, then click on the “Add Collector” button.

Figure 3 - Collectors management area on Lumu Portal.

When creating a Virtual Appliance, you are required to provide the following information:

1. Name : a name for your VA Collector.
2. Type : the type of metadata you want this VA collector to process (Netflow).

Figure 4 - Creating a VA collector.

Set Up a VA Collector

Once you have created the Netflow collector at the Lumu Portal, go to the Virtual Appliance and refresh the VA collectors settings by running the command lumu-appliance collectors refresh. The newly created collector will be presented:

When continuing, you will be prompted to select the device type:

The first option applies to NetFlow/IPFIX. Once selected, the following selection will be presented:

Reverse and post are referred to the fields where the information about the response flow is going to be expected, reverse as in reverse_octet_delta_count or post as in post_octet_delta_count. Usually, Softflowd sends the information in reverse fields and nProbe sends it in post fields. If you don’t know which is your case, contact our support team to help you do a capture and verify.

For the Packetbeat option, you will be requested to set the port number. Keep in mind that this should be a positive number below 65535, numbers above 1024 are highly recommended as ports below 1024 are usually used by other applications, and may require different privileges to run. Be sure to select a port that is not used by any other collector. Port 5044 is already in use by the appliance.

We recommend reloading the appliance after changing the configuration files to make sure the new settings are applied. 

To reload the VA, run the command lumu-appliance reload

Netflow Configuration

In this section, we show how to leverage third party solutions to collect IP traffic data and have IP conversation visibility into your network. While we provide guidance for nProbe and Softflowd, you can configure other third party tools to listen to the SPAN port, synthesize flow information and send it to Lumu, as long as the data generated follows the NetFlow or IPFIX standards.

Once you decide which tool you want to deploy to synthesize network flows, you have to install it in a physical machine where you set up two ports (network interface controller - NIC), one to listen to the SPAN port and another one to export flows to the Lumu Virtual Appliance.

The next step is to configure your network flow generating device or software to send the information to the port you set when configuring the Lumu Virtual Appliance Collector.

Additionally, you should configure the solution to use one of the supported protocols: NetFlow v5, v9 or v10/IPFIX.

If the device/solution uses a protocol v9 or v10/IPFIX, make sure the following fields are configured:

1. protocol_identifier
2. tcp_control_bits
3. end_reason
4. flow_duration_milliseconds
5. source_transport_port
6. destination_transport_port
7. octet_delta_count
8. packet_delta_count
9. flow_end_sys_up_time
10. flow_start_sys_up_time
11. source_ipv4_address or source_ipv6_address
12. destination_ipv4_address or destination_ipv6_address
    

If you use the bidirectional version of the protocol, make sure the corresponding fields are also enabled.

Depending on the device you are using, there may be additional steps required to successfully collect network flow data. Consult your vendor documentation for guidance.

Netflow Configuration with nProbe

nProbe is a tool provided by ntop. For detailed information on installing nProbe, search for appropriate instructions on the ntop website.

You can find an example of configuring nProbe as a flow synthesizer for the Lumu Virtual Appliance below. The flag -i should be used with the name of the interface where the SPAN port is connected. The flag -n should be used with the IP of the Lumu VA and the port configured to listen for network traffic data.

Note, we use the template option since the default template used by nProbe doesn’t contain the fields expected by the Lumu Virtual Appliance.

To review the appliance logs for any problems, run the following command in the Lumu VA:

            

             
version: '3'
services:
  dns_collector:
	image: docker.elastic.co/beats/packetbeat:7.9.3
	network_mode: host
	cap_add: ['NET_RAW', 'NET_ADMIN']
	container_name: lumu_flows_collector
	hostname: lumu_flows_collector
	restart: unless-stopped
	volumes:
  	- "./packetbeat.yml:/usr/share/packetbeat/packetbeat.yml"
	logging:
  	    driver: syslog
  	    options:
    	       syslog-format: "rfc3164"
    	       tag: "lumu_flows_collector"
            

            

             
packetbeat.interfaces.device: *replace*
packetbeat.interfaces.type: af_packet

packetbeat.protocols:
  - type: icmp
    ports: true

packetbeat.flows:
  timeout: 30s
  period: -1s

processors:
  - include_fields:
  	fields:
    	- source
    	- destination
    	- type
    	- event.duration
    	- event.start
    	- network.transport
    	- network.type
    	- flow
    	- icmp

output.logstash:
  hosts: ["appliance_ip:collector_port"]

logging:
  level: info
  metrics.enabled: false

http.enabled: true
monitoring.enabled: false                            
            

After configuring both files, use docker compose to start Packetbeat with the following command: