By configuring Sycope as a NetFlow collector for FortiGate, organizations can use data already generated by their firewall infrastructure as a source for continuous network analysis.
The integration does not require a dedicated proprietary connector. FortiGate exports flow records to the configured Sycope collector, where they become available for dashboards, searches, reporting, alerting and historical analysis.
Table of Contents
From FortiGate sessions to network analysis
FortiGate supports NetFlow export for traffic observed on configured interfaces. The NetFlow configuration defines the collector IP address and port, while NetFlow sampling is enabled on the interfaces whose traffic should be included. Fortinet also maintains full NetFlow information based on firewall sessions.
Sycope receives these records through its NetFlow collector and processes them as part of the same network data model used for other flow exporters.
Each flow contains information describing network communication, such as source and destination addresses, ports, packet and byte counts, timestamps and interface information. Sycope uses this data to reconstruct communication patterns and provide historical visibility into activity across the monitored network.
This allows traffic passing through FortiGate to be analyzed beyond the individual firewall session and placed in a wider historical and behavioral context.
Complementary capabilities, clearly divided
FortiGate and Sycope remain independent platforms and perform different roles in the network architecture.
FortiGate provides:
- Firewalling and traffic enforcement
- Network session information
- Interface-level traffic visibility
- NetFlow export
- Security inspection and policy enforcement
- Routing and network connectivity
Sycope provides:
- NetFlow collection and analysis
- Host-to-host communication visibility
- Historical network traffic data
- Network performance analysis
- Network anomaly and threat detection
- Traffic search and filtering
- Dashboards, reporting and alerting
- Asset and application context
FortiGate controls and observes traffic as it crosses the firewall, while Sycope uses the exported flow information to analyze communication over time and across the wider monitored environment.
Using existing FortiGate infrastructure for network visibility
Organizations already operating FortiGate firewalls can use their existing devices as flow exporters without introducing another traffic source solely for network monitoring.
Communication between systems
Flow records exported by FortiGate show which systems communicate through the firewall, when the communication occurs and how much traffic is exchanged.
Sycope stores and analyzes this information over time, allowing teams to review communication involving a specific IP address, service or part of the network.
This provides useful context when investigating connectivity issues, unexpected communication or changes in traffic behavior.
Traffic volumes and network usage
NetFlow records include packet and byte counters that allow Sycope to analyze how network capacity is being used.
Traffic can be examined by host, service, interface, application or other attributes available in the flow data. Historical views make it possible to compare current activity with previous periods and identify changes in network usage.
The same data can support capacity analysis, troubleshooting and identification of systems or services responsible for unexpected traffic volumes.
Network behavior and security analysis
Flow data can also provide evidence of activity that is difficult to assess from a single connection or log entry.
Sycope analyzes communication patterns across the network and can use flow information to identify anomalies and security-related behavior.
FortiGate remains responsible for enforcing firewall and security policies, while Sycope provides an additional analytical layer based on the communication observed over time.
This gives security and network teams a historical view of activity involving systems protected by the FortiGate infrastructure.
Historical traffic context
Firewall information is often reviewed in response to a current event. Flow retention in Sycope makes it possible to return to an earlier time period and examine the communication that occurred around an incident or performance problem.
An analyst can review which systems communicated with an affected host, which services were used, when connections started and how traffic volumes changed.
This historical context can support both operational troubleshooting and security investigations.
Visibility across multiple FortiGate interfaces
NetFlow export is configured on the FortiGate interfaces whose traffic should be monitored.
Fortinet allows NetFlow sampling to be enabled per interface and supports collection of both directions of traffic. The collector configuration determines where the resulting flow records are sent.
This makes it possible to select the parts of the FortiGate environment that should contribute network data to Sycope rather than treating the firewall as a single undifferentiated traffic source.
In larger environments, traffic from multiple FortiGate devices can be sent to the Sycope collector and analyzed within the same platform. Sycope identifies flow exporters and provides statistics about the data received from individual sources.
The result is a common analytical view across traffic exported by different network devices.
Flow data without duplicating firewall functionality
The integration does not attempt to reproduce FortiGate firewall policies or security controls in Sycope.
FortiGate continues to handle traffic according to the configured firewall, routing and security policies. Sycope consumes the resulting flow information and uses it for network monitoring and analysis.
This separation allows each platform to remain focused on its primary role.
Firewall teams can continue managing FortiGate through the existing Fortinet environment, while NOC and SOC teams gain an additional historical and analytical view of the network communication observed by those devices.
How the integration works
The integration consists of three main elements.
NetFlow export on FortiGate
NetFlow is configured on FortiGate with the IP address and port of the Sycope collector.
Current FortiGate configurations allow one or more collectors to be defined together with parameters such as the source IP and interface used to reach the collector.
NetFlow sampling is then enabled on the interfaces whose traffic should be exported.
FortiGate also allows the active and inactive flow timeouts to be configured. Sycope recommends an active timeout of 60 seconds and an inactive timeout of 15 seconds for NetFlow exporters.
NetFlow collection in Sycope
Sycope is configured to listen for incoming NetFlow records.
The default NetFlow port in Sycope is 2055, although additional or different ports can be configured when required by the environment.
Sycope supports several flow protocols, including NetFlow v5, NetFlow v9 and IPFIX, allowing flow information from FortiGate to be analyzed together with data from other compatible network devices.
Analysis, visualization and alerting
After the flow data is received and decoded, it becomes available to the analytical functions in Sycope.
Teams can use the data in dashboards, NQL searches, reports and monitoring rules. Historical flow information can also be used during troubleshooting and security investigations.
FortiGate therefore acts as one of the network data sources, while Sycope provides the environment in which communication from multiple exporters can be analyzed over time.
FortiGate in multi-VDOM environments
FortiGate also supports NetFlow in multi-VDOM deployments, although the configuration depends on the role of the VDOM.
Fortinet documents separate handling for management and non-management VDOMs, with global configuration used where the management VDOM inherits NetFlow settings from the global context.
For larger Fortinet environments, the exact exporter configuration should therefore be aligned with the FortiGate topology and VDOM architecture before the flow data is sent to Sycope.
The Sycope side of the integration remains the same: exported NetFlow records are received by the collector and processed as network data associated with the relevant exporter.
From firewall traffic to historical network context
Consider an internal server whose traffic passes through a FortiGate firewall.
FortiGate processes the connections according to its existing firewall policies and exports information about the sessions to Sycope through NetFlow.
Sycope records the communication and makes it available for ongoing monitoring and historical analysis.
If the server later experiences a performance problem or becomes involved in a security investigation, the team can review its previous network activity in Sycope. Communication partners, services, traffic volumes and changes in behavior can be examined for the relevant time period.
The firewall continues to enforce network policy, while the exported flow data provides the historical evidence required to understand how the system communicated.
FortiGate and Sycope integration
FortiGate NetFlow export provides a direct way to use existing firewall infrastructure as a source of network data for Sycope.
Traffic processed by FortiGate can be analyzed together with flow data from other network devices, providing a broader view of communication, performance and security behavior without changing the firewall’s role in the environment.
To discuss using FortiGate flow data with Sycope, contact our team.
