How to avoid Netflow record for denied traffic

Tulasi — Wed, 08 Sep 2021 08:49:03 GMT

Hi !

we have configured Netflow server and the profile is attached to Inside interface, we are getting Netflow records and it seems working fine. but what we have observed is, we are seeing the Netflows for the traffic which is getting denied by Firewall rule also and they are marked as Flow denied in the event type. i am searching for the option to stop sending the netflows for the traffic denied by firewall rule but i could not find any so far. please help me if any one knows how to do it ?
Thanks in advance

Re: How to avoid Netflow record for denied traffic

PavelK — Fri, 17 Sep 2021 23:21:35 GMT

Thank you for posting question @Tulasi

The event you are referring to is recorded in the NetFlow Template, Value: 233 (firewallEvent) 3 = Flow denied—The NetFlow data record indicates a flow that firewall policy denied. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/netflow-monitoring/netflow-templates.html

I was searching myself whether there is any way to exclude some flows or build a custom NetFlow Template to exclude some of the values, but I have not found any option to configure it directly on Firewall. Unless you can exclude it on NetFlow Collector/Analyzer side, there is likely no option to do it. I know that with some NetFlow Analyzers it is possible to filter view to exclude some hosts or subnets.

Kind Regards

Pavel

topic How to avoid Netflow record for denied traffic in Log Forwarding Discussions

How to avoid Netflow record for denied traffic

Re: How to avoid Netflow record for denied traffic