Submit a ticketCall us

WebinarUpcoming Webinar: How Help Desk and Remote Support Pays for Itself

Learn how help desk software can simplify ticketing management, allow you to track hardware and software assets, and accelerate the speed of IT support and service delivery. Gain insights on how remote support tools allow your IT team to maximize their efficiency and ticket resolution by expediting desktop troubleshooting, ultimately helping keep end-users happy and productive.

Register here.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Palo Alto devices - How to configure Netflow Server Profile and assign to interface

Palo Alto devices - How to configure Netflow Server Profile and assign to interface

Created by Joseph Esquitin, last modified by Joseph Esquitin on Feb 13, 2018

Views: 4,568 Votes: 1 Revisions: 5

Overview

The following steps will guide you through creating a Netflow profile and assigning the profile to desired interfaces to collect and export Netflow data.

Environment

  • All Netflow Versions

Steps

Steps

The following steps describe how to configure the Netflow Server Profile:

  1. Go to Device > Server Profiles > Netflow.
  2. Click Add to bring up the Netflow Server Profile.
  3. Add a Name for the Netflow settings.
  4. Click Add and fill the Name (name to identify the server) and Server (hostname or IP address of the server) field.
  5. It is recommended to change the defaults for both the 'Template Refresh Rate' and Active Timeout (mn)' to 1  minute.   This will reduce gaps in data from a max of 30 minutes to 1 minute if the server is rebooted or the Netflow service restarts.  The NetFlow service is unable to process the flow data until the template is received and also by changing the Active timeout will eliminate high peaks every 5 minutes above the circuit speeds due to long-lived flows.
  6. The port is automatically populated as 2055, but can be edited if needed, as shown below:

 

The profile can be assigned to an existing Palo Alto Networks firewall interface so that all traffic flowing over that interface is exported to the Netflow collector specified server above.

 

To assign the profile created above to the interface, follow the steps below:

  1. Click on Network > Interfaces, go to either Ethernet, VLAN, Loopback or Tunnel tab.
  2. Select any interface and assign the above created Netflow Server Profile ( Netflow_Profile1) in the Netflow Profile field:

 

Next, you will configure a service route for the interface that the firewall will use to send the NetFlow data. For PA-7000 and PA-5200 series firewalls, the management interface cannot be used to send the NetFlow data. The interface configured in the service route does not have to be the same as the interface that is collecting the NetFlow data.

 

1. To configure a service route, select the 'Device' tab from the main menu. Select 'Setup' from the list on the left and then the click the 'Services' tab. Click 'Service Route Configuration' at the bottom.

 

image.png

 

 

2. Select 'Customize,' and then click on the word 'NetFlow.'

 Please note that SolarWinds only supports the IPv4 protocol.

 

image.png

 

3. Select 'Source Interface' from the drop-down list, and then select the 'Source Address' that will be used to send the NetFlow data.

"Any," "Use default," and "MGT" (or management) are not valid interface options for sending NetFlow records from the PA-7000 Series or PA-5200 Series firewalls.

Click 'OK' to exit from the Service Route Source and then 'OK' to exit the service Route Configuration.

 

Select 'Source Interface' from the drop-down list, and then select the 'Source Address' that will be used to send the NetFlow data.

 

image.png

 

NOTE: "Any," "Use default," and "MGT" (or management) are not valid interface options for sending NetFlow records from the PA-7000 Series or PA-5200 Series firewalls.

Click 'OK' to exit from the Service Route Source and then 'OK' to exit the service Route Configuration.

 

4. The final step is to click the 'Commit' button in the upper-right corner of the window. Please note that clicking 'Save' WILL NOT apply your changes and the NetFlow data will not be exported. This is the most common reason that NetFlow data is not exported even though everything has been configured correctly.

The "Save" button simply saves the XML configuration to a file whereas the "Commit" button saves and applies the config changes.

 

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.

 

Last modified

Tags

Classifications

Public