Currently NetFlow is showing destination (of inbound traffic) as our outside IP rather than inside IP. Also, for all outbound traffic, it is showing the source as our firewall rather than workstations. Any ideas about how to find the true source/destination for these?
I take it you have a set-up somewhat similar to this:
LAN - FW - Router ---- Internet
With NATing in the firewall? If so, there's no obvious way you can get true destinations directly in NetFlow, because as far as the router ins concerned, the only source of packets is the NAT pool in the firewall. It may be possible to extract the NAT mappings from the firewall on a regular basis, then post-process the NetFlow data, but I suspect it would require some bespoke coding and be error-prone.
In short, no, I think you're out of luck.
If we take a few liberties with actual IP addresses: Inside: 192.168.0.0/24 NAT pool: 172.27.10.3 - 172.27.10.5
Let us trace a TCP packet from inside host 192.168.0.17 to outside host 22.214.171.124
Eventually a return packet arrives:
As the NAT happens in the firewall, the router only ever sees the "outside" addresses and is unable to correlate the "inside" IP to any given packet.
I agree with the previous answer. We have 8 routers I monitor netflow on and this is the method I have used.
It's been a while since I played with this, but I think that I had a similar problem. If memory serves, I had to tell IOS to reference the traffic from my LAN interface instead of my WAN interface. Obviously this is dependent on your topology, but I think the following command soled it for me: