Device Integration: Juniper Switches sFlow

TABLE OF CONTENTS

• Overview
• Prerequisites
• Configuration Steps
  • Verify Settings on Juniper CLI
  • On Juniper Switch (CLI)
• Verification (MSSP Only)
  • On ADR CCE (Collector)
  • On ADR SIEM UI

Overview

This guide explains how to integrate NetFlow (sFlow) from Juniper switches into ADR SIEM (aiSIEM/aiXDR). Flows from Juniper devices are exported to the CCE (Collection and Control Engine) and forwarded to the APE (Analytics and Policy Engine) for comprehensive visibility, proactive threat detection, and traffic analytics.

Prerequisites

• SSH or Telnet access to the Juniper switch.
• Privileged (configure) mode access on the switch.
• Correct system date/time and timezone on the switch.
• Valid SSH/Telnet credentials with management privileges.
• ADR CCE server IP address.
• UDP port 6343 (default sFlow port) open between the Juniper switch and the CCE.

Configuration Steps

Step 1: Connect to Switch

SSH into the Juniper switch:

ssh admin@<Switch_IP>

configure

Step 3: Configure sFlow Agent

(Optional but recommended for device identification)

set protocols sflow agent-id <Switch_Management_IP>

set protocols sflow collector <CCE_IP> udp-port 6343

Apply sFlow to the required interfaces:

set protocols sflow interfaces <interface>

set protocols sflow interfaces ge-0/0/0

Set sampling rates and polling intervals (adjust as per network load):

set protocols sflow polling-interval 60
set protocols sflow sample-rate ingress 1024
set protocols sflow sample-rate egress 1024

Step 7: Commit Changes

commit

On Juniper Switch (CLI)

Run the following commands to verify settings:

show sflow collector
show sflow interface

Verification (MSSP Only)

On ADR CCE (Collector)

1. Log in to the CCE server.
2. Run:

   sudo tcpdump -i any port 6343 and host <Juniper_Switch_IP> -AAA

   This confirms sFlow packets are arriving from the switch.

On ADR SIEM UI

1. Log in to the ADR SIEM UI with admin rights.
2. Navigate: System → Logs and Flows Collection Status.

3. Verify that the Juniper switch IP appears under Source Device IP.

4. Ensure flows are being collected in near real time.