Filtering Cisco Meraki MX Netflow

Hello,

Thank you for your message.

To avoid getting bandwidth data for specific interfaces, it is preferable to configure the NetFlow exporter (your device) to discard them when collecting data. This will avoid extra work for both device and PRTG.

You can of course use the Exclude filter field as well. To get an idea of the data transmitted, you can create a new toplist with the column(s) you desire to filter on (ex: Source/Destination VLAN). To create a new toplist, I invite you to have a look at this YouTube video from our colleague Ben: https://youtu.be/JfQ64NlfptE?t=718.

Here is more information regarding how to filter the data: https://www.paessler.com/manuals/prtg/xflow_packet_sniffer_filter_rules#examples.

Regards.

Unfortunately, for Meraki devices your choices for NetFlow are to enable or disable it. You cannot configure what traffic to send out :(

This is not great as this generate more flows and therefore consume more ressources than necessary on both sides. Have you created the toplist to check the information received and applied filter(s) already?

I believe I got a filter created to only track traffic that goes out our WAN interface and the Client VPN. It wasn't fun to develop due to the number of VLANs we have, and it isn't super pretty but it appears to work for what I need.

My current exclude filter is as follows not (SourceIP[192.168.250.0/24] and (DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[10.0.4.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[192.168.22.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[192.168.23.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[192.168.24.0/23] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[192.168.26.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[192.168.27.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[10.100.100.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[10.101.101.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[172.16.20.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[192.168.199.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[206.146.235.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[206.146.235.0/24] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[172.27.199.0/26])) and not (SourceIP[172.27.199.0/26] and (DestinationIP[192.168.250.0/24] or DestinationIP[10.0.4.0/24] or DestinationIP[192.168.22.0/24] or DestinationIP[192.168.23.0/24] or DestinationIP[192.168.24.0/23] or DestinationIP[192.168.26.0/24] or DestinationIP[192.168.27.0/24] or DestinationIP[10.100.100.0/24] or DestinationIP[10.101.101.0/24] or DestinationIP[172.16.20.0/24] or DestinationIP[192.168.199.0/24] or DestinationIP[206.146.235.0/24]))

Thought my filter was working, but apparently it is too long and will not save. So I've reached out to Meraki support to see if they can filter the traffic on their side so I only get traffic that traverses the WAN interface.

Thank you for your feedback.

As you have many VLANs to exclude, I would recommend to use the Include filter instead. This way, you can only filter the interfaces you want and therefore make the filter much more readable as well as shorter.

Hopefully, Cisco could also help here on their side.

I checked, Meraki is not able to filter the Netflow export for me and the Netflow export does not include any interface information in it. So I have no way to know if the traffic is passing through the WAN interface or a client VPN tunnel unless I check to see if its source & destination are not an internal VLAN. SNMP won't work either, tried that as well :(

When you say "the Netflow export does not include any interface information in it", have you checked with the toplist as mentioned above (by enabling the interesting fields) and with Wireshark (on the probe server you should receive CFLOW packets with data)?

Have you checked if you have the possibility to rely on one or multiple filters (list available here) to only keep the traffic you desire by using the Include filters field instead.