Question & Answer
Question
In this article, we exemplify how you can ingest Netflow through a bonded interface.
Answer
QRadar supports bonded interfaces in order to collect flows.
STEPS
- Create a bonded interface by following steps here: https://www.ibm.com/docs/en/qsip/7.5?topic=management-configuring-network-interfaces
- The network interface displays configured in a similar manner (interface names can differ):
- Restart hostcontext service on the flow collector or flow processor, where interface was created:
systemctl restart hostcontext - Create a flow source, which uses a Network Interface, follow the steps on this page: https://www.ibm.com/docs/en/qsip/7.5?topic=sources-adding-editing-flow-source
Result: Netflow is now ingested through a bonded interface.
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwsuAAA","label":"Flow Source"}],"ARM Case Number":"TS012991212","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
18 December 2023
UID
ibm17028106