EDFN Installation Guide

The External Data Feeder for NFO (EDFN) is required for ingesting Cloud Flow Logs (AWS, Azure, GCP) or for security architectures where NFO is isolated from the internet.

Check for Bundled Version

If you installed NFO version 2.7 or higher, EDFN is already installed on your NFO host. You only need this guide if you require a standalone EDFN instance on a separate server.

System Requirements & Supported Platforms

• System: 4 CPU Cores, 8GB RAM.
• Linux (x86_64):
  • Rocky Linux 8, 9, 10
  • Red Hat Enterprise Linux 8, 9, 10
  • Oracle Linux 7, 8, 9, 10
  • Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS
  • Debian 11, 12
• Windows: Windows Server 2019, 2022, 2025.

Required Network Ports

For NetFlow Optimizer and the External Data Feeder for NFO (EDFN) to function correctly, ensure the following network connectivity is established.

Management & Internal Communication

The following port is the primary management channel and must be open on the NFO host to allow incoming connections from the EDFN service:

Port	Protocol	Direction	Description
8443	TCP	Inbound to NFO	Critical: Management UI and secure EDFN-to-NFO communication (HTTPS).

Outbound Agent Communication

The EDFN service does not "listen" on the ports below; rather, it initiates outbound connections to external data sources. The specific ports required depend entirely on the Enrichment Agents you enable:

• Internet Communication: Most cloud-based agents (e.g., Threat Intel, AWS/Azure, GeoIP updates) require outbound access on TCP 80 and TCP 443.
• Infrastructure Agents: Other agents may require specific outbound ports depending on the service being polled (e.g., TCP 5985/5986 for WinRM/Active Directory, or TCP/UDP 443 for VMware vCenter).

Installation Instructions

Linux

note

EDFN installation default directory is /opt/nfi-updater.

1. Download the RPM (nfi-updater-<version>-linux.x86_64.rpm) or TAR (nfi-updater-<version>-linux-x86_64.tar.gz) package from the NetFlow Logic Downloads page. Only <version> changes between releases; the rest of the file name is literal.
2. Install (RPM):

rpm -ivh nfi-updater-*-linux.x86_64.rpm

3. Install (TAR):

tar zxvf nfi-updater-*-linux-x86_64.tar.gz
./setup.sh -i

note

The setup.sh script includes an optional --doNotStartServices parameter, which prevents the EDFN service from starting automatically after installation. This is useful when EDFN configuration is copied from one machine to another or installing the service as non-root.

4. Start Service: Unless --doNotStartServices parameter is used, EDFN service is started automatically. You can check if it is running using this command:

systemctl status nfi_updd

If it is not running, start it using this command:

systemctl start nfi_updd

Windows

1. Download the nfi-updater-<version>-x86_64.exe.zip installer package from the NetFlow Logic Downloads page. Only <version> changes between releases; the rest of the file name is literal.
2. Unzip the package and launch the installer.
3. Follow the setup wizard.
4. Verify: Open services.msc and ensure External Data Feeder for NFO is "Running."

Post Installation Steps

note

If External Data Feeder for NFO is installed on a separate server, or if you have several EDFNs connected to one NFO, perform the following:

1. Stop the EDFN service:

   • Linux: systemctl stop nfi_updd
   • Windows: use the Services snap-in in Microsoft Management Console.

   On distributions that do not use systemd, use rc-service nfi_updd stop (OpenRC) or service nfi_updd stop.

2. Change uri parameter in updater.properties file located in /opt/nfi-updater/conf (In Windows C:\Program Files\NetFlow Logic\NetFlow Integrator Updater\conf) to IP address or DNS name of NetFlow Optimizer

   uri = https://<nfo-host>:8443

3. If this is your second EDFN instance, set a unique EDFN identifier in uid

   uid = EDFN2

4. Copy Java KeyStore and TrustStore from EDFN installed with NFO ($EDFN1_HOME) to EDFN installed on a separate machine ($EDFN2_HOME)

   From	To
   $EDFN1_HOME/conf/.updater_keystore	$EDFN2_HOME/conf/.updater_keystore
   $EDFN1_HOME/conf/.updater_truststore	$EDFN2_HOME/conf/.updater_truststore

5. Start the EDFN service:

   • Linux: systemctl start nfi_updd
   • Windows: use the Services snap-in in Microsoft Management Console.

   On distributions that do not use systemd, use rc-service nfi_updd start (OpenRC) or service nfi_updd start.