Ipswitch WhatsUp Gold User Guide - Ipswitch Documentation Server

Ipswitch WhatsUp Gold User Guide
If the device is outside the firewall, the exported flow data aggregates all traffic to
and from internal devices and reports it as belonging to a single public address
belonging to the device performing the address translation. In this case, you can only
determine that an internal device originated or received traffic, but you cannot
pinpoint the traffic as belonging to a specific internal device.
If the device exporting flows is also performing NAT, you can configure the device to
export the flow data using either the private or the public translated address,
mimicking either of the above scenarios. To see internal IP addresses, configure the
device to export data on ingress and egress for the internal interface. To see all
traffic reported using the external translated IP address, configure the device to
export data on ingress and egress for external interfaces. For more information,
see Manually configuring network devices to export flow data to Flow Monitor (on page
973).
Other conditions that may also change the nature of the data reported by Flow Monitor
include:
When address translation occurs anywhere in the path between the source and the
destination, IP addresses reported are altered to include the translated address. In
most cases, this does not present a problem, but it may require monitoring multiple
flow-enabled devices to track traffic in complex network environments.
Virtual private networks and other tunneling technology (such as ESP or SSH) can
appear to distort reports. In these cases, Flow Monitor reports large amounts of traffic
sent over a small number of flows. This is expected behavior, as VPNs and other
tunnels aggregate traffic from multiple connections and funnel it through a single
connection.
Manually configuring devices to export flow data to Flow Monitor
Network devices must be configured to generate and send NetFlow data to Flow Monitor.
This is accomplished manually using the device's command line interface (CLI), or
automatically through the Source configuration dialog (Flow Monitor > Configuration) for
devices that are NetFlow enabled and have the Cisco NetFlow MIB (OID: 1.3.6.1.4.1.9.9.387).
973