Overview

​We are providing you with the steps to integrate your Extreme Switch with Seceon SIEM so One can have Comprehensive visibility and Proactive Threat Detection in your Environment. There will be a log transfer between your firewall to APE(Analytics and Policy Engine) via CCE (Collection and Control Engine ). In this document, we are guiding you through the steps for Netflows forwarding.

Steps Of Configuration

You can perform Extreme Switch NetFlow configuration using the following steps:

set netflow export-interval 1
set netflow export-destination {NETFLOW_SERVER_IP} {NETFLOW_SERVER_LISTENER_PORT}
set netflow cache enable
set netflow export-version 9
set netflow template refresh-rate 600 timeout 1

Enter global configuration mode on the router or MSFC, and issue the following commands for each interface on which you want to enable flow:

set netflow port {INTERFACE_NAME} enable both

VERIFICATION OF CONFIGURATION

Verification can be done either from CCE Server or from UI.

Using UI

STEP 1: Log in to UI >> SYSTEM

Open

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS.

Open

STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.

Using CCE SERVER

“sudo tcpdump -i any port 9995 and host <IP address> -AAA” command should be running on the CCE server to check whether or not we are getting logs.