DocumentationDeployment

UniFi Integration

UniFi gateways (UDM, UDM Pro, UDM SE, USG, UCKP) can send network data to FlowPro NG via two channels — Syslog for event logs and NetFlow for traffic flow analysis. No changes are needed on the FlowPro side — both collectors are ready to receive data.

Data source	Protocol / Port	Data in FlowPro
Syslog	UDP 514	Firewall logs, DHCP, VPN, auth events, IDS/IPS alerts
NetFlow	UDP 12051	Network traffic flows — source/destination IP, ports, protocols, data volumes

For maximum visibility, enable both Syslog and NetFlow. Syslog provides security events and firewall decisions, while NetFlow provides complete traffic flow analysis with anomaly detection.

UniFi OS (UDM, UDM Pro, UDM SE)

Open UniFi Network settings

In the UniFi Network application, go to Settings → System → Advanced.

Enable Remote Syslog

•Enable "Remote Syslog Server"
•Syslog Host: YOUR_FLOWPRO_IP
•Port: 514
•Log level: Normal (or Verbose for more detail)

Enable IDS/IPS logging (optional)

Go to Settings → Security → Threat Management. Enable IDS or IPS mode. Alerts will be forwarded via syslog automatically.

Legacy USG / UCKP

Open classic UniFi Controller

Go to Settings → Site → Remote Logging in the UniFi Controller.

Configure syslog target

•Enable "Remote Syslog Server"
•Syslog Host: YOUR_FLOWPRO_IP
•Port: 514

Verification

bash

# Check incoming syslog from UniFi
tail -f /var/log/syslog | grep -i unifi

# Or check Logstash pipeline
curl -sk https://localhost:9200/logs-*/_count?q=host.ip:UNIFI_IP

Syslog data will appear in Log Explorer within seconds.

Replace YOUR_FLOWPRO_IP with the actual IP address of your FlowPro NG server.

UniFi OS (UDM, UDM Pro, UDM SE)

Enable via SSH

SSH into your UniFi gateway (enable SSH in UniFi OS Settings → Console Settings → SSH). NetFlow export is not available in the UI — it must be configured via CLI.

Configure NetFlow export

bash

# On UDM / UDM Pro / UDM SE via SSH:
set protocols netflow version 5
set protocols netflow server YOUR_FLOWPRO_IP port 12051
set protocols netflow engine-id 1
set protocols netflow enable-egress all
set protocols netflow timeout expiry-interval 60
commit

On UDM-based devices, these settings may reset after firmware updates. To persist them, use the on_boot.d script method (see Persistence section below).

Legacy USG

Configure via UniFi Controller

On USG devices, NetFlow is configured via config.gateway.json on the controller. Create or edit the file:

bash

# On UniFi Controller:
cat > /srv/unifi/data/sites/default/config.gateway.json << 'EOF'
{
  "system": {
    "flow-accounting": {
      "netflow": {
        "version": "5",
        "server": {
          "YOUR_FLOWPRO_IP": {
            "port": "12051"
          }
        },
        "timeout": {
          "expiry-interval": "60"
        },
        "engine-id": "1"
      },
      "ingress-capture": "post-dnat",
      "interface": {
        "eth0": ""
      }
    }
  }
}
EOF

# Force re-provision the USG from the controller

After saving config.gateway.json, force-provision the USG: Devices → USG → Settings (gear icon) → Manage → Force Provision. The config persists across reboots.

Verification

bash

# Check incoming NetFlow data
journalctl -u nfacctd-flowpro-datasource1 -n 20 --no-pager

NetFlow data will appear in Flow Collector → Flows tab within one minute.