Docs
test1test2
6.5
6.5
  • ElastiFlow Documentation
  • Unified Flow Collector
    • General Configuration
    • Changelog
    • Maxmind GeoIP2 and GeoLite2
    • RiskIQ PassiveTotal
    • Network Interfaces
    • User-Defined Metadata
    • Docker
    • Linux
    • Unified Flow Collector Introduction
    • System Requirements
    • Supported IEs
    • AWS VPC Flow Log IEs
    • IPFIX IEs
    • Netflow IEs
    • sFlow IEs
  • Unified SNMP Collector
    • Device Groups
    • Changelog
    • Devices
    • Downloading Definitions
    • Enumerations
    • Objects
    • Object Groups
    • User-Defined Metadata
    • Docker
    • Network Interfaces
    • United SNMP Collector Introduction
    • Linux
    • Scheduling Rediscovery
  • Monitoring ElastiFlow
    • Liveness & Readiness
    • Metrics
    • Prometheus & Grafana
  • Configuration Reference
    • YAML Configuration Files
    • Configuration Reference Overview
    • Common
      • API
      • Licensing
      • Overview
      • Logging
      • HTTP output
      • Elasticsearch output
      • Kafka output
      • Monitor output
      • OpenSearch output
      • Splunk output
      • stdout output
      • Processor
    • Unified Flow Collector
      • Overview
      • Community/Conversation IDs
      • EF_PROCESSOR_ENRICH_TOTALS_IF_NO_DELTAS
      • Overview
      • RiskIQ PassiveTotal
      • Maxmind
      • User-Defined Metadata
      • Overview
      • Overview
      • User-Defined Metadata
      • Overview
      • Benchmark Input
      • Netflow/IPFIX/sFlow (UDP)
      • Licensing
      • Decoder/Processor
      • Sample Rate
      • Configuration Changes
    • Unified SNMP Collector
      • User-Defined Metadata
      • Overview
      • Licensing
      • SNMP Poller
      • EF_PROCESSOR_SNMP_ENUM_DEFINITIONS_DIRECTORY_PATH
  • API Reference
    • API Reference Overview
    • SNMP Operations
  • Data Platforms
    • Elastic
      • Basic Cluster
      • Advanced Cluster
      • Single Server
      • Multi-Tier Cluster
      • Single "Lab" Server
      • Elasticsearch
      • ElastiFlow vs. Filebeat and Logstash
      • RHEL/CentOS
      • Ubuntu/Debian
      • Kibana
      • ML
        • Network Security
        • Machine Learning
        • Availability
          • Network Availability
          • DHCP
          • LDAP
          • DNS
          • NTP
          • RADIUS
          • TCP Sessions
        • Network Security Activity
          • Rare Autonomous System
          • Network Activity
          • Rare Conversation
          • Rare Geolocation
        • Network Security Brute Force
          • Brute Force CLI Access
          • Brute Force Remote Desktop Access
          • Brute Force Attacks
        • Network Security DDoS
          • Denial-of-Service
          • ICMP Flood Attack
          • SYN Flood Attack
          • TCP DDoS Attack
          • UDP Amplification Attack
        • Network Security Recon
          • ICMP Scan
          • Reconnaissance
          • Port Scan
        • Performance
          • Unusual ASN Traffic Volume
          • Unusual Network Interface Traffic Volume
          • Network Performance
    • Opensearch
      • Dashboards
      • Auth Sig V4
    • Splunk
      • Default Search Macro
      • Configuring Data Input & Index
      • Splunk App Installation
    • Output Configuration
  • Additional Guides
    • Catalyst (sFlow)
    • FortiGate
    • hsflowd
    • Configuring Flow Sampling on Juniper Routers
    • Junos OS (sFlow)
    • MikroTik RouterOS
    • OpenWRT (softflowd)
    • Ubiquiti EdgeRouter
    • SonicWall
    • Junos OS
    • Extending SNMP Device Support
    • Flow Device Support Overview
    • SNMP Device Support Overview
    • Generating A Support Bundle
  • FAQ
    • Flows stopped showing up in Kibana (Disk(s) Full)
    • Common reasons why you have discrepancies between ElastiFlow data & reality
    • What Are Snapshots?
    • Importing the wrong dashboards (No data)
  • Knowledge Base
    • Config
      • Elasticsearch Authentication Failure
      • CA Certificate Path Incorrect
      • license/error Invalid Segments
    • Flow
      • Bidirectional Flow Support
      • Configure the UDP Input
      • Flow Records Not Received
      • Netflow v9/IPFIX Template Not Receieved
      • Unsupported sFlow Structures
    • General
      • License Has Expired
      • License Agreement Not Accepted
    • Install
      • .deb Upgrade Fails File Overwrite
    • Operation
      • Flow Collector Queues 90% Full
      • Dashboard Updates
      • Change elastiflow-* Index Name?
  • Elastic Stack Deployment
  • Download Links
Powered by GitBook
On this page
  • Access the EdgeRouter CLI
  • Enter configuration mode
  • Configure the NetFlow or IPFIX settings
  • Commit and save the changes
  • Exit configuration mode
  • Verify the configuration
  1. Additional Guides

Ubiquiti EdgeRouter

Configuring flow accounting on a Ubiquiti EdgeRouter involves enabling NetFlow or IPFIX (Internet Protocol Flow Information Export) on the router, which allows it to collect and export flow data to the ElastiFlow Unified Flow Collector. Here's a step-by-step guide on how to configure flow accounting on a Ubiquiti EdgeRouter using the Command Line Interface (CLI):

Access the EdgeRouter CLI

Connect to your EdgeRouter via SSH or a console cable. If connecting via SSH, use a tool like PuTTY or the built-in SSH client in your terminal, and enter the router's IP address, username, and password to log in.

Enter configuration mode

Once logged in, enter configuration mode by typing the following command:

configure

Configure the NetFlow or IPFIX settings

To enable NetFlow or IPFIX on the EdgeRouter, you'll need to configure the settings for the flow accounting protocol, including the interface(s) on which to monitor traffic, the version of the protocol, and the IP address and port of the remote flow collector or analyzer. Use the following commands, replacing the example values with your specific configuration:

For NetFlow:

set system flow-accounting netflow enable-egress
set system flow-accounting netflow interface ethX
set system flow-accounting netflow server x.x.x.x port yyyy
set system flow-accounting netflow version 9

For IPFIX:

set system flow-accounting ipfix enable-egress
set system flow-accounting ipfix interface ethX
set system flow-accounting ipfix server x.x.x.x port yyyy
set system flow-accounting ipfix version 10

Replace ethX with the interface you want to monitor (e.g., eth0), x.x.x.x with the IP address of your flow collector, and yyyy with the desired port number for the flow collector (e.g., 2055).

Commit and save the changes

After configuring the flow accounting settings, commit and save the changes by entering the following commands:

commit
save

Exit configuration mode

Type exit to leave configuration mode and return to the EdgeRouter CLI.

Verify the configuration

To verify that flow accounting is configured correctly, use the following command:

show system flow-accounting

This command should display the flow accounting settings you just configured.

Once you've completed these steps, your Ubiquiti EdgeRouter will start exporting flow data to the specified flow collector or analyzer. Make sure your that the ElastiFlow Unified Flow Collector is set up to receive and process the exported data for analysis and monitoring purposes.

PreviousOpenWRT (softflowd)NextSonicWall