> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/netflow-ddos-detector/setup.md).

# Setup

## Prerequisites <a href="#cloudinsights-configurationexamplestowardslink11-howtosetupnetflowtowardsthelink11netflowcollector" id="cloudinsights-configurationexamplestowardslink11-howtosetupnetflowtowardsthelink11netflowcollector"></a>

Netflow DDoS Detector is an extension of Link11’s Network DDoS Protection service; thus, this service is required in order to use it.

## Overview

Setting up Netflow DDoS Detector requires the following:

* **Setting up Netflow** towards the Link11 collector (described below).
* **For customers wishing to automatically route traffic into Link11 during attacks**, they must also:
  * **Define the conditions that will trigger the rerouting** of traffic into Link11. This is done in the [Config](/product-guides/netflow-ddos-detector/interface/config.md) part of the interface.
  * **Define the conditions for automatically releasing the routes** again. This is done in the [Smart Routing](/product-guides/netflow-ddos-detector/interface/smart-routing.md) part of the interface.
* **For customers wishing to manually route traffic** into/out of Link11:
  * This is done as-needed in the [Config](/product-guides/netflow-ddos-detector/interface/config.md) part of the interface.

{% hint style="warning" %}
**IMPORTANT NOTE:**

When exporting NetFlow data to our platform, please configure the **active timeout** to **60 seconds (1 minute)**.

By default, many devices (such as Cisco IOS and Juniper forwarding-options monitoring) use an **active timeout of 30 minutes (1800 seconds)**. This can cause problems in scenarios with long-lived connections. With a 30-minute active timeout, all long-lived traffic may be reported as a single flow record only once every 30 minutes. As a result, rerouting can be triggered unnecessarily and overall monitoring accuracy may be reduced.

To avoid this behavior, always set the NetFlow active timeout to **1 minute**. This ensures that flows are exported regularly, GRE traffic is split into manageable records, and rerouting decisions are made based on up-to-date information.
{% endhint %}

## How to setup Netflow towards the Link11 Netflow collector <a href="#cloudinsights-configurationexamplestowardslink11-howtosetupnetflowtowardsthelink11netflowcollector" id="cloudinsights-configurationexamplestowardslink11-howtosetupnetflowtowardsthelink11netflowcollector"></a>

1. Link11 will set up IP and Port, and will give this information to the customer
2. Setup on every “not Link11”-facing CE Router is recommended

For Juniper the config looks like:

```
set forwarding-options sampling family inet output flow-server 85.131.135.232 port 4111
set forwarding-options sampling family inet output flow-server 85.131.135.232 no-local-dump
set forwarding-options sampling family inet output flow-server 85.131.135.232 source-address 80.80.80.80
set forwarding-options sampling family inet output flow-server 85.131.135.232 version 5
```

For a CISCO-XE the config looks like:

```
flow exporter LINK11_NETFLOW_SAMPLES
 destination 85.131.135.232
 source GigabitEthernet0/0/2
 transport udp 4111
 option interface-table timeout 120
```

3. The information can be seen on the WebGUI as soon as the flow information reaches the given IP and port.

{% hint style="warning" %}
**IMPORTANT NOTE:**&#x20;

Please do not use the option "option sampler-table timeout 120" while sending Netflow data to Link11. This option adds an additional byte to the flow sampler interval field (field 50) and this is not supported from our side.
{% endhint %}