Deployment
NetFlow Optimizer (NFO) scales from a single virtual machine to a distributed cluster. This page covers what you need before you install: host requirements, network ports, and which architecture to choose. It then points you to the installation guide for your platform.
Choosing an Architecture
Most deployments are single-node. Move to a distributed architecture when data volume, network segmentation, or availability requirements call for it.
| Architecture | Use it when |
|---|---|
| Single node | Standard choice. NFO and the External Data Feeder run on one host. |
| Separate External Data Feeder | The NFO host has no outbound internet access, so the feeder runs in a DMZ and pushes updates inward. |
| NFO Central with peers | Flow volume exceeds what one node can process, or you need high availability. Linux only. |
For a full comparison, including cloud and hybrid scenarios, see Deployment Architecture and Strategy.
Recommended Distributed Architecture
In a single-node deployment everything runs on one host, so no role assignment is needed. In a distributed deployment, divide the work as follows.
On NFO Central:
- The built-in External Data Feeder, which becomes a shared External Data Feeder and delivers watch lists to the peers.
- SNMP Management and SNMP auto-discovery, which build the device inventory for the whole cluster.
- Module 10701 (Auto-discovery Reporter), which reports the discovered inventory and topology.
On each NFO Peer:
- The NetFlow processing modules, which do the flow work the cluster is scaled for.
- Module 10103 (SNMP Custom OID Sets Monitor), which reports device metrics for the devices assigned to that peer.
How SNMP work is divided. NFO Central discovers devices once for the cluster, then assigns a subset of them to each peer. Each peer polls only its assigned devices and reports their metrics. Discovery stays central because the inventory is cluster-wide; polling spreads across peers because it is load.
Host Requirements
These requirements apply to any node running NetFlow processing modules: a single-node instance or an NFO Peer.
| Component | Minimum | Recommended for production |
|---|---|---|
| CPU | 2 cores | 4 to 8 cores |
| Memory | 8 GB RAM | 16 GB RAM, which gives enrichment room to work |
| Disk space | 20 GB | 100 GB or more, for logs and local caching |
| OS (Linux) | RHEL or Rocky 8 and later, Ubuntu 20.04 and later | RHEL 9 or Rocky Linux 9 |
| OS (Windows) | Windows Server 2016 | Windows Server 2022 |
NFO Central does not run NetFlow processing modules, so its resource profile differs from a processing node. It distributes flows to peers rather than processing them itself, which is why a single NFO Central handles a substantially higher flow rate than a single processing node. See NFO Central for distributed deployment guidance.
Network Ports
| Purpose | Port |
|---|---|
| Flow ingestion (NetFlow, IPFIX, sFlow) | UDP 9995 |
| Web interface and management | TCP 8443 |
| Enrichment updates, outbound from the External Data Feeder to the internet | TCP 443 |
Installation Guides
Single node (NFO with built-in External Data Feeder)
- Linux, for RPM and TAR.GZ deployments
- Windows, using the installer for Windows Server
- AWS, launching from the Amazon Machine Image
Distributed components
- Standalone External Data Feeder, needed only when the NFO host cannot reach the internet
- NFO Central, for scaling across multiple nodes under one management interface
After Installing
Once the software is installed and your network devices are exporting flows, verify the pipeline end to end: ingestion, enrichment, and output. See Deployment Validation.
Frequently Asked Questions
Do I need to install the External Data Feeder separately?
No. Since NFO 2.7 the External Data Feeder is bundled with NFO. A separate installation is needed only when the NFO server cannot reach the internet to download threat lists and GeoIP updates.
Can I run NFO as a non-root user?
Yes. See Running as Non-Root for the post-install steps.
NFO Central and any node running Repeater functionality must run with root privileges, because they forward NetFlow packets while preserving the original exporter's IP address.