Flowmon for Azure

Overview

Flowmon for Azure provides network administrators and security engineers insight into what is happening in their cloud infrastructure. Its powerful features can be used to gain control of bandwidth utilization, optimize network and application performance, reduce time to resolution during troubleshooting, and keep the infrastructure protected against modern cyber-security threats.

Flowmon for Azure is:

• published in the official Azure Marketplace,
• deployed in the form of an Azure Virtual Machine Instance,
• capable of collecting in addition to generating flow data,
• suitable for cost optimization with dynamic instance resizing based on current/planned utilization,
• fully under your control - including updates, backups, and configuration.

Features

Flowmon for Azure supports three modes of operation:

• Probe,
• Collector,
• Collector and Probe.

Flowmon Probe

In this mode, the virtual appliance acts as a Flowmon Probe. It accepts mirrored traffic on monitoring ports and exports flow data to at least one remote Flowmon Collector instance.

Flowmon Probe for Azure allows:

• traffic monitoring on all supported Network Traffic Sources,
• monitoring of traffic mirrored with Azure Virtual Network TAP (in selected regions, as a preview).

Flowmon Collector

In this mode, the virtual appliance acts as a Flowmon Collector and accepts supported flow formats from external probes, network devices, or cloud services on management ports. The Flowmon Collector for Azure works with all supported Network Flows Source Types. For further details on supported flow sources and formats, refer to the official Flowmon User Guide.

Flow sources specific to Azure:

• Azure VNET Flow Logs

Flowmon Collector and Flowmon Probe

In this mode, the virtual appliance acts both as a Flowmon Probe and Flowmon Collector. The Probe sends data to the locally available Collector. For details on configuration, refer to the official Flowmon User Guide.

Licensing

Flowmon for Azure is a virtual appliance with Bring-Your-Own-License (BYOL) support.

With BYOL, you can apply for a Free Trial License at progress.com. We recommend this approach.

For support or inquiries, see our contact information.

Azure Marketplace

Flowmon for Azure is available as a Virtual Appliance (VA) in Azure Marketplace.

Supported Azure instance sizes

Flowmon 13.1.0 does not support Azure virtual machines with Accelerated Networking enabled. This limitation affects almost all VM sizes except for the B-series, so we recommend using the B-series.

When Accelerated Networking is enabled, Azure presents two interfaces with the same MAC address to the guest operating system. Flowmon identifies interfaces by MAC address and treats duplicate MAC addresses as a conflict, preventing correct network interface configuration.

On affected instances, the network interface is unavailable in Flowmon Configuration Center, monitoring ports do not capture traffic, and no flow data is produced, although the appliance remains reachable through the management interface.

Workaround

Select an instance size without Accelerated Networking. Alternatively, disable Accelerated Networking on the network interface, noting that this reduces network throughput. If Flowmon is already running on an affected instance, contact Progress Technical Support before changing the deployment.

Prerequisites

To follow this guide, you must have the following:

• A web browser compatible with the Azure Portal.
• A trial license from progress.com.
• An active Azure user account with a subscription (free or paid).

To deploy Flowmon for Azure, follow these steps:

1. Log in to the Azure Portal.

2. Go to the Azure Marketplace page for Flowmon.

3. Click Get It Now.

4. Continue with the deployment in the Azure Portal.

5. Create a virtual machine instance.

6. Provide mandatory information such as the Virtual machine name, Resource group, Size and so on. You can use the Flowmon Collector Model List to estimate the correct sizing of your instance.

7. Configure the user account:

   • Change the default username from azureuser to flowmon.
   • Provide an SSH public key for the flowmon user account.

8. In Disks, add an additional block device to serve as data storage. Select the disk types suitable for your performance versus cost requirements.

9. In Networking, review the network interface settings and adjust them based on the specifics of your network topology.

10. In Monitoring, ensure Boot diagnostics are enabled.

11. Review + create the new instance.

12. Wait for the deployment to finish and retrieve the machine's public IP address from its details.

If you need to use this instance as a Flowmon Probe, refer to the Virtual Network Interfaces section below.

Virtual Network Interfaces

Once the new instance is running, you may provision additional monitoring interfaces (depending on your license). The most common configuration is eth0 for management and eth1/eth2 for monitoring.

Identify interfaces by MAC address inside the running instance, because the order and numbering may be different.

Virtual Disks

Once the new instance is running, you may provision additional data storage if you have not already done that during the initial deployment process. It is recommended to store flow data on a disk other than the OS disk automatically provided with the instance. Adjust the disk capacity based on your license. For more information about the data migration, refer to the User Guide.

Flowmon Configuration

Refer to Post-installation Steps for details.

Azure Virtual Network TAP

The Azure Virtual Network TAP service preview is currently suspended by Microsoft and is therefore unavailable for customer deployments.