How to configure NetFlow on MikroTik RouterOS devices

These instructions assume:

• The Mikrotik RouterOS version is 6.38 or higher. *
• The date, time and time zone are correctly set on the router.
• You have Telnet or SSH credentials and access to the MikroTik router.
• The IP address of your Auvik collector is known.

* Versions older than 6.38 may incorrectly display flow lengths in TrafficInsights. In version 6.38, the NetFlow export issues causing the incorrect display have been resolved.

If you are using a shared collector and want TrafficInsights to associate flow data with the correct site, you must add the source IP address as a dedicated /32 network within Auvik.

For example:

192.168.1.10/32

Even if the source IP address is already included in a larger monitored subnet, a dedicated /32 entry is required for TrafficInsights to correctly associate flow records with the appropriate site.

After making this change, it may take several minutes before flow data appears in TrafficInsights.

Access your router CLI

1. Telnet or SSH into your router.
2. Enter privileged mode by typing enable and entering your enable password.

Enable NetFlow export

On the router, run the following command. Replace AuvikCollectorIP with the IP address of your Auvik collector, AuvikPort with one of the following ports: 2055, 2056, 4432, 4739, 6343, 9995 or 9996.

/ip traffic-flow set active-flow-timeout=1m enabled=yes
/ip traffic-flow target add dst-address=<AuvikCollectorIP> port=<AuvikPort>

Note: For Mikrotik RouterOS version 7.5 or higher, you need to add a third line of code to set the source IP for the router.

/ip traffic-flow set enabled=yes active-flow-timeout=1m src-address=<RouterSourceIP>