Device Integration: TP-Link Switch

TABLE OF CONTENTS

• Overview
• Prerequisites
• Steps of Configuration
  • Step 1 – Log in to the TP-Link device
  • Step 2 – Navigate to sFlow settings
  • Step 3 – Configure the sFlow Collector
  • Step 4 – Configure Interfaces for sFlow Monitoring
• Verification of Configuration (MSSP Only)
  • On CCE Server
  • On ADR UI
• Reference

Overview

This document provides step-by-step guidance for integrating a TP-Link switch or firewall with ADR using sFlow. This integration forwards network flows directly to the Collection and Control Engine (CCE), enabling the Analytics and Policy Engine (APE) to provide comprehensive visibility and proactive threat detection.

Prerequisites

• Admin credentials for the TP-Link device.

• ADR CCE IP address.

• UDP port 6343 must be open between TP-Link device and ADR CCE.

• Device firmware must support sFlow (check TP-Link model documentation).

Steps of Configuration

Step 1 – Log in to the TP-Link device

Use administrator credentials to access the TP-Link Web UI.

Step 2 – Navigate to sFlow settings

Go to:
Maintenance → sFlow → sFlow Collector

Step 3 – Configure the sFlow Collector

Fill in the following parameters:

• Collector ID: Auto-assigned (up to 4 supported).

• Description: (Optional) Provide a label, e.g., ADR_CCE.

• Collector IP: Enter your CCE server IP address.

• Collector Port: 6343 (default).

• Maximum Datagram Size: Set to 1400 (default is 300, but higher size improves efficiency).

• Timeout (s): 0 (always valid).

• Lifetime (s): Auto-calculated based on timeout.

Click Apply to save settings.

Step 4 – Configure Interfaces for sFlow Monitoring

1. Go to: Maintenance → sFlow → sFlow Agent.

2. Enable sFlow on required interfaces (e.g., uplink ports or core interfaces).

3. Configure:

   • Sampling Rate (e.g., 1024) → controls how frequently packets are sampled.

   • Polling Interval (e.g., 60 seconds) → controls how often counters are sent.

4. Apply changes.

Without enabling sFlow on interfaces, no traffic will be exported.

Verification of Configuration (MSSP Only)

On CCE Server

Run the following command to check incoming sFlow packets:

sudo tcpdump -i any port 6343 and host <TP link IP>

If packets are visible, flows are reaching the CCE.

On ADR UI

1. Log in with admin credentials.

2. Navigate to: System → Logs and Flows Collection Status.

3. Check if the Source Device IP of the TP-Link device appears.

Reference

• TP-Link Official Guide – Configuring sFlow