NetFlow not Working with Qradar

Nathus — Fri, 30 Jun 2023 09:55:16 GMT

Hello !

Im having issue with my netflow configuration on the PA5260 in HA mode.

I'm not receiving any log on my Qradar where as i have configure the netflow by following the https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJzCAK

The following Step have beeen done:

1. Netflow profil created

2. Profil applied on a subinterface

3. use of ae3 interface in a service route.

4. connectivite between ae3 interface and the Qradar

And my HA peer is not synchronize also even i try manuel config sync

The configuration is like something in below

show | match netflow
set deviceconfig system route service netflow source address 10.10.10.14/29
set deviceconfig system route service netflow source interface ae3.600
set network interface tunnel units tunnel.11 netflow-profile NetFlow_SOC_Qradar
set network interface tunnel units tunnel.14 netflow-profile NetFlow_SOC_Qradar
set shared server-profile netflow NetFlow_SOC_Qradar server Qradar host 1.1.1.1/24
set shared server-profile netflow NetFlow_SOC_Qradar server Qradar port 2055
set shared server-profile netflow NetFlow_SOC_Qradar template-refresh-rate minutes 1
set shared server-profile netflow NetFlow_SOC_Qradar template-refresh-rate packets 20
set shared server-profile netflow NetFlow_SOC_Qradar active-timeout 1
set shared server-profile netflow NetFlow_SOC_Qradar export-enterprise-fields no
set shared admin-role Monitor-full-access role device webui device server-profile netflow read-only

Thansk in advance for your help.

Best Regards

Re: NetFlow not Working with Qradar

Nathus — Sun, 02 Jul 2023 02:51:32 GMT

Hello,

I found the solution.

For the HA to remain synchronize, we need to set the service route manually on both platforms (active and passive) to be the same interface data (PA 52xx and PA 7xxx).

Once you complete your netflow configuration on the active PA and you commit, the cluster (HA) will synchronize correctly.

Thanks;

topic Re: NetFlow not Working with Qradar in General Topics

NetFlow not Working with Qradar

Re: NetFlow not Working with Qradar