After you have viewed and filtered the flow monitoring data that you want to collect, you can configure data collection.

You can filter the data being displayed by specifying exclusion criterion. For example, you may want to exclude a proxy server to avoid seeing duplicate flows. Or if you are running a Nessus scan on the virtual machines in your inventory, you may not want to exclude the scan flows from being collected. You can configure IPFix so that information for specific flows are exported directly from a firewall to a flow collector. The flow monitoring graphs do not include the IPFix flows. These are displayed on the IPFix collector's interface.

Procedure

  1. In the vSphere Web Client, navigate to Networking & Security > Tools > Flow Monitoring.
  2. Select the Configuration tab.
  3. Ensure that Global Flow Collection Status is Enabled.
    All firewall related flows are collected across your inventory except for the objects specified in Exclusion Settings.
  4. To specify filtering criteria, click Flow Exclusion and follow the steps below.
    1. Click the tab corresponding to the flows you want to exclude. ip
    2. Specify the required information.
      If you selected Specify the following information
      Collect Blocked Flows Select No to exclude blocked flows.
      Collect Layer2 Flows Select No to exclude Layer2 flows.
      Source Flows are not collected for the specified sources.
      1. Click the Add icon.
      2. In View, select the appropriate container.
      3. Select the objects to exclude.
      Destination Flows are not collected for the specified destinations.
      1. Click the Add icon.
      2. In View, select the appropriate container.
      3. Select the objects to exclude.
      Destination ports Excludes flows to the specified ports.

      Type the port numbers to exclude.

      Service Excludes flows for the specified services and service groups.
      1. Click the Add icon.
      2. Select the appropriate services and/or service groups.
    3. Click Save.
  5. To configure flow collection, click IPFix and follow the steps as described in IPFIX for Distributed Firewall.
  6. Click Publish Changes.