> For the complete documentation index, see [llms.txt](https://help.highlight.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.highlight.net/device-setup/appvis-tm-and-flow-configuration.md). # AppVis™ and Flow - Configuration ## Overview This page shows sample device configuration for AppVis™ (Cisco only) and Flow (a sequence of packets from a source computer to a destination. Highlight Flow reports on the top 20 flows by volume for a given time period, using IP address and port numbers) (IPFIX, Netflow and J-Flow). Configuration for NBAR (Network-Based Application Recognition - mechanism used by Cisco devices to recognise applications, packets are inspected using DPI (Deep Packet Inspection)) on Cisco routers is also available. Details are on the **NBAR configuration page**. AppVis/Flow can cause a high CPU load so the monitored device needs to be adequately sized for the volume of traffic expected at each location. ## AppVis™ AppVis is only supported for Cisco routers, and each router: * should have an NBAR2 protocol pack licensed and installed Note: NBAR2 is not a pre-requisite for AppVis which could use standard NBAR classification. However standard NBAR has significantly fewer signatures than NBAR2 so AppVis would be less granular in the information it reports. Licence details are available from [Reporting inventory](https://help.highlight.net/reporting/inventory) * must have Flexible Netflow configured. An example configuration follows: Note: existing Flow configuration for version 5 or version 9 should be removed from the router first ``` flow exporter highlight-exporter description the fields to be used in the export packet header destination **IP address of Collector** source **interface that matches IP address in Highlight** transport udp 9996 ! flow record highlight-appvis description the fields to be sent in the individual flow records in a flow packet match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input match interface output match application name collect counter bytes collect counter packets ! flow monitor highlight-monitor description the exporter/record combination to be applied to interfaces for flow collection exporter highlight-exporter record highlight-appvis ``` And on the interface to be monitored for Flow ``` interface GigabitEthernet0/0 ip flow monitor highlight-monitor input ip flow monitor highlight-monitor output ``` If the WAN interface carries only encrypted or encapsulated traffic, the LAN interface should be configured for AppVis Flow. Also, ensure the Flow exporter source address is not NATed. ## Cisco NetFlow Set out below are details of the Cisco IOS commands needed for Highlight to report Flow information, and a description of their function. See below for the **equivalent Juniper commands**. The Flow configuration: * specifies the Flow version (version 9 recommended if available; version 5 is also supported) * defines the destination address of the NetFlow collector (a Highlight Agent) * specifies the interface on the device that has the source IP address used to send Flow packets to the Flow collector Some Cisco devices may only support Flexible NetFlow configuration, please see below for the **Flexible NetFlow configuration**. ### Flow version 9 configuration ``` ip flow-export version 9 ip flow-export destination **IP address of Collector** 9996 ip flow-export source **interface to match the source IP address in Highlight** ``` Then on the monitored interface ``` ip flow egress ip flow ingress ``` ### Flow version 5 configuration ``` ip flow-export version 5 ip flow-export destination **IP address of Collector** 9996 ip flow-export source **interface to match the source IP address in Highlight** ``` Then on ALL interfaces carrying traffic ``` ip flow ingress ``` ### Additional configuration In addition to configuring Flow settings, it is recommended interface persistence is also added to avoid loss of Flow monitoring if the interface numbering changes. ``` snmp-server ifindex persist ``` ## Cisco Flexible NetFlow Highlight can support Flexible NetFlow using the 'Legacy' template only. This is an alternative to the configuration defined previously and both configurations should not be deployed together. ``` flow exporter highlight-exporter destination **IP address of Collector** transport udp 9996 export-protocol netflow-v5 source **interface that matches IP address in Highlight** ! flow monitor highlight-monitor record netflow ipv4 original-input exporter highlight-exporter cache timeout active 1 cache timeout inactive 15 ``` And on the interface to be monitored for Flow ``` ip flow monitor highlight-monitor input ip flow monitor highlight-monitor output ``` ### Additional configuration In addition to configuring Flow settings, it is recommended interface persistence is also added to avoid loss of Flow monitoring if the interface numbering changes. ``` snmp-server ifindex persist ``` ## Juniper J-Flow Set out below are details of the Juniper commands needed for Highlight to report J-Flow information. Assuming ge-0/0/0 to be your interface for flow analysis: ``` set interfaces ge-0/0/0 unit 0 family inet sampling input set interfaces ge-0/0/0 unit 0 family inet sampling output ``` For a sampling rate of 1 in *n* packets. Use n=1 for all packets to be analysed ``` set forwarding-options sampling input rate n ``` For a Flow Collector with IP address nnn.nnn.nnn.nnn ``` set forwarding-options sampling family inet output flow-server nnn.nnn.nnn.nnn port 9996 set forwarding-options sampling family inet output flow-server nnn.nnn.nnn.nnn version 5 ``` The Juniper interface selected in Highlight for Flow analysis should be the ".0" sub-interface. For the example above, select ge-0/0/0.0 in Highlight. ## FortiGate Firewall Set out below is a summary of the FortiGate commands needed to report NetFlow information in Highlight. Details have been extracted from this [Fortinet technical page](https://kb.fortinet.com/kb/documentLink.do?externalID=FD36460). For a Flow Collector with IP address nnn.nnn.nnn.nnn: ``` config system netflow set collector-ip nnn.nnn.nnn.nnn set collector-port 9996 end ``` Then add Flow to the monitored interface: ``` config system interface edit **interface to be monitored for Flow** set netflow-sampler both end ``` If wishing to monitor a WAN interface with PPPoE but it fails to report, try configuring the LAN interface for monitoring, and use "Swap I/O" in the Highlight watch configuration. ## Related * **Agent Installation** * **Configuring Highlight Flow** * [Flow on the Details page](https://help.highlight.net/details/bearers-traffic-analysis/flow-specifics) * [Comparing NBAR and Flow](https://help.highlight.net/details/bearers-traffic-analysis/nbar-and-flow) * **Setting up Flow in Highlight** * [Planning for Flow collection](https://help.highlight.net/device-setup/agent-installation) * **Troubleshooting Flow** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.highlight.net/device-setup/appvis-tm-and-flow-configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.