Table of Contents (Start)

Flow Rules

This documentation applies to NMS version 5.4. An online version of the software can be found here.

The Flow Rules page enables you to define global rules to not process the flow data SevOne NMS receives. SevOne NMS evaluates the rules you define and applies the rule that is most specific to each source. When you enable devices to send flow data to SevOne NMS, SevOne NMS allows and processes all flow data by default. Networks have the potential to send large amounts of flow traffic. The Flow Rules page enables you to define global rules to deny the processing of flows. You can override the rules you define here for specific interfaces from the Flow Interface Manager.

To access the Flow Rules page from the navigation bar, click the Administration menu, select Flow Configuration, and then select Flow Rules.

images/download/attachments/11509889/flowrules.png

Flow Rules List

The list displays all flow rules by default. Click the Display drop-down to display rules for All Sources, Allowed Sources, or Denied Sources.

Device - Displays the name of the device for which the rule is applicable. Displays New when the rule applies to new devices that have yet to send flow to SevOne NMS. Displays Unknown when you do not enable the SNMP plugin and the device name is not resolvable.
IP Address - Displays the device IP address.
Interface - Displays the interfaces for which the rule is applicable. Displays New when the rule applies to new interfaces that have yet to send flows to SevOne NMS.
Direction - Displays Incoming when the rule applies to incoming traffic. Displays Outgoing when the rule applies to outgoing traffic. Displays New when the rule applies to flows that are from devices that are new in SevOne NMS.
Permission - Displays Allow when SevOne NMS processes the flow data across the interface. Displays Deny when SevOne NMS does not process the flow data across the interface.
Peer – Displays the name of the peer to which you define the device to send flow data.

Add and Edit Flow Rules

Perform the following steps to manage the rules in the list.

– Select the check box for each rule to manage, click , and then select one of the following options.
- Select Allow Selected Flows to process the flow data across the interface.
- Select Deny Selected Flows to not process the flow data across the interface.
- Select Delete to delete the rules.

Perform the following steps to add and edit flow rules.

Click Add Rule or click to display the Add/Edit Flow Rule pop-up.
Click the Peer drop-down and select the peer to which you define the device to send flow data.
Click the Device drop-down and select the device from which you want to define a flow rule. If you select Specify, enter the IP address in the IP Address field.
Click the Interface drop-down and select the interface for which you want to apply the rule. If you select Specify, enter the interface number in the Interface Number field.
Click the Direction drop-down.
- Select New to apply the rule to any applicable new flow incoming or outgoing.
- Select Incoming to apply the rule to data that comes into the device. V5 NetFlow is an ingress technology that can only report on data that the interface receives.
- Select Outgoing to apply the rule to data that goes out from the interface. For v5 NetFlow, SevOne NMS uses data from other flows to create an estimation of outgoing flows.
Select a Permission option.
- Select Allow to process the flow data across the interface.
- Select Deny to not process the flow data across the interface.
Click Save. When the rule specifies both a device and an interface, a message appears to indicate the rule is specific enough to be a Flow Interface Manager rule and the rule appears on the Flow Interface Manager not the Flow Rules page.