How to configure sFlow on FortiGate Firewalls

These instructions assume:

• Your device is running FortiOS 4.0MR2 or later
• The date, time, and time zone are correctly set on the firewall.
• You have SSH credentials and access to your Fortigate firewall
• You know the IP address of your Auvik collector.

Access your firewall CLI

1. Telnet or SSH into your firewall.
2. Ensure you're logged in as a privileged user.

Configure sFlow

1. Set the sFlow collector address & port. In the following commands, replace <AuvikCollectorIP> with the IP address of your Auvik collector and <AuvikPort> with one of the following port numbers: 2055, 2056, 4432, 4739, 6343, 9995, or 9996 (default is 6343).
   

   config system sflow
   
   set collector-ip <AuvikCollectorIP>
   
   set collector-port <AuvikPort>
   
   end

    

2. Configure the sFlow agent on an interface - usually this will be the LAN interface(s). Replace <InterfaceName> with the name of the interface where you’ll enable flow reporting. Replace <SampleRate> with the sampling rate you’d like to use - default is 2000.
   

   config sys interface
   
   Edit <InterfaceName>
   
   set sflow-sampler enable
   
   set sample-rate <SampleRate>
   
   set sample-direction both
   
   set polling-interval 60
   
   next
   
   end

Reference:

https://kb.fortinet.com/kb/documentLink.do?externalID=FD32024