Testing NetFlow with Ubiquiti

I’ve been running a Ubiquiti stack of network gear for the last 10 years. I started with a Dream Machine Pro, a single AP, and two AP repeaters when I was renting a home. I’ve always liked their dashboards and management, but their support for standard network management and monitoring tools has always felt lacking.

I should back up a moment. If you weren’t aware, I have spent nearly 20 years in the IT Operational Monitoring and Management (ITOM) space. I have used many different tools to gather information about my network gear and servers. I’ve always run a home lab, even when it was just a handful of Pentium computers running VMware GSX.

I’ve worked with everything from open source tools like Nagios and Cacti to commercial solutions like Microsoft Operations Manager and Splunk. However, most of my career centered around the SolarWinds solutions. In this article, I’m going to use the SolarWinds Observibility Self-Hosted solution, but the output should apply for any solution that can receive and interpret IPFIX NetFlow traffic.

Many years ago, Ubiquiti added support for SNMP to their devices, but it omitted the Dream Machine Pro. I was upset, but understood. The Dream Machine Pro wasn’t like any other switch, router, or firewall. It included its own management framework. Although there were articles for how to forcibly enable SNMP on the Debian-based platform, the results were less than stellar. This did mean that any other switch or access point I had on my network could utilize SNMP and I could get up/down status, packets, CPU/memory, and other metrics exposed through the SNMP service.

After I moved into my current home, I went all out and installed a (then) new Dream Machine Special Edition, several U7 Pro access points, one U6 Mesh for outside, and a bunch of compact switches.

This week, Ubiquiti released an update to their Unifi OS for my Dream Machine Special Edition (version 4.1.13) which added NetFlow support if your Network Application is up to date (at least version 8.5.6). I was excited to kick the tires.

How to Enable NetFlow on Ubiquiti Dream Machine

Enable SNMP on the Dream Machine

Firstly, I needed to add support for SNMP on my Dream Machine itself. Global settings (like the community strings) are handled via the Settings / System / Integrations area within the UniFi management application.

Here you define your community strings and choose if you want SNMP v2, v3, or both.

Configure SNMP on the Infrastructure Devices

Once that’s done, you’ll need to update the individual devices in your infrastructure to enable SNMP. Start in UniFi Devices, select each device you’d like to add to SNMP and set the Location and Contact information.

Realistically, you probably don’t need to do this portion, but if you’re going to do something, you may as well do it right.

Add Devices to Monitoring

Now it’s time to add the devices to your monitoring solution. Do this as you would any other SNMP device. In my scenario, I elected to stick with SNMPv2 for simplicity’s sake.

In the SolarWinds ecosystem, these devices show up as “net-snmp” devices because (at their heart), these are Debian machines running the net-snmp service. There are ways to tweak this, but for the purposes of getting NetFlow working, it’s unnecessary.

It’s worth noting that my Dream Machine is running multiple IP Addresses (192.168.0.1, 192.168.4.1, 192.168.21.1, etc.), but I elected to use the IP on the same VLAN as my netflow receiver. Otherwise, you could get errors like:

Enable NetFlow on the Dream Machine

Now it’s time to go back to UniFi and enable the NetFlow integration. Again, we’ll go to Settings / System /Integrations. We’ll check the box for NetFlow, select the VLANs (Networks) and fill out a few more things.

• Version: 9
• Collector Address: <Address of your SolarWinds Polling Engine>
• Sampling Mode: Deterministic
• Sampling Rate: 512

I’ve tried no sampling ranging from Off to 1,024 flows on Hash, Random, and Deterministic. I’ve found the above to provide the best option for my needs.

Bask in your Flow Data

After a few minutes, you’ll return to your SolarWinds platform and data will be flowing.

And that’s all it took. Probably about 15 minutes worth of work and NetFlow data is streaming from my Dream Machine Special Edition to my monitoring solution.

About hte only thing I don’t like about the Dream Machine’s SNMP instead of the other switches is the port naming. On the Dream Machine, the names appear as eth# whereas on the other switches it appears as Port #. But this is easily remedied with a few edits.

We now return you to your regularly scheduled program and I’ll see you next time, ramblers.