topic Re: Monitor subinterfaces and get NetFlow statistics in General Topics

Monitor subinterfaces and get NetFlow statistics

MMCiobanu — Wed, 14 May 2014 23:21:32 GMT

Hi,

We have a PA-5020 and configured a few AGG interfaces with subinterface; recently, we installed a SolarWinds NTA to get NetFlow statistics, but I am not able to get anything from this device.

I have created a profile and applied to the subinterface through which the Internet traffic goes, but it does not send any information to the NetFlow collector.

Also, is there a way we can monitor the AGG and subinterfaces using SNMP?

We do manage the device with SNMP through the management interface and I can see the physical interfaces, but not the AGG and subinterfaces.

Thank you very much.

Re: Monitor subinterfaces and get NetFlow statistics

HULK — Thu, 15 May 2014 00:37:23 GMT

Hello MMCiobanu,

Could you please let me know the type of Netflow you have configured here.

With the exception of vendor specific variations of NetFlow, there are 2 different implementations of NetFlow:

Standard Netflow: The standard NetFlow implementation will collect all IP traffic information.
Sampled Netflow: Only 1 out of x packets is processed. For internet backbones is standard NetFlow to resource intensive, that's why they only collect samples instead of all the traffic.

The Palo Alto Networks firewall supports the standard NetFlow implementation.

Thanks

Re: Monitor subinterfaces and get NetFlow statistics

HULK — Thu, 15 May 2014 00:54:12 GMT

Hello MMCiobanu,

Prior to PAN-OS 6.0.0, NetFlow data could not be exported on a per-subinterface basis. Starting in PAN-OS 6.0.0, NetFlow data can be exported on a per-subinterface basis.

Bug 43280 - Exported Netflow Logs Aggregates Sub-interface Data

Thanks

Re: Monitor subinterfaces and get NetFlow statistics

MMCiobanu — Thu, 15 May 2014 02:32:15 GMT

It is standard netflow.

Re: Monitor subinterfaces and get NetFlow statistics

MMCiobanu — Thu, 15 May 2014 02:36:01 GMT

Will version 6 also enable monitoring AGG and subinterfaces? I believe, if the interface is not seen through SNMP from the device, the collector cannot get the Netflow information; not quite sure though.

Re: Monitor subinterfaces and get NetFlow statistics

HULK — Thu, 15 May 2014 04:06:29 GMT

Hello MMCiobanu,

PAN OS version 6.0.x will workfor monitoring AGG and subinterfaces.

Thanks

Re: Monitor subinterfaces and get NetFlow statistics

MMCiobanu — Thu, 15 May 2014 13:30:11 GMT

thank you very much; it looks like there are quite a few advantages to upgrade to 6.0

Re: Monitor subinterfaces and get NetFlow statistics

MMCiobanu — Fri, 20 Jun 2014 23:42:28 GMT

we have upgraded to 6.0.3, still not able to monitor the AGG and subinterfaces

Re: Monitor subinterfaces and get NetFlow statistics

SimonBlackler — Tue, 15 Jul 2014 10:05:46 GMT

We're in the same boat.

I'm incredibly surprised that PANOS has got to version 6 without support for subinterfaces and AE bundles via SNMP?!

This is pretty critical stuff...

Re: Monitor subinterfaces and get NetFlow statistics

pulukas — Tue, 15 Jul 2014 21:09:38 GMT

I agree that the snmp polling option really should be there.

The obvious work around is to pull the data from the connected port on the switch where other network vendors do give us this data. (hint, hint to PA).

Re: Monitor subinterfaces and get NetFlow statistics

ajbool — Tue, 15 Jul 2014 21:31:53 GMT

SNMP polling for tunnel interfaces would be good too!

Re: Monitor subinterfaces and get NetFlow statistics

pulukas — Tue, 15 Jul 2014 21:34:18 GMT

Does anyone have the feature request numbers for these snmp updates?

FR####

I should send a vote off to my sales team while I'm thinking about it.

Re: Monitor subinterfaces and get NetFlow statistics

hshah — Wed, 16 Jul 2014 01:10:17 GMT

Hello MMC,

As long as I know Netflow/SNMP are allowed only on Physical Interfaces.

Please find bellow mentioned FR No.

Netflow on Sub interfaces FR#3058

SNMP on Sub interfaces FR#780

Regards,

Hardik Shah

Re: Monitor subinterfaces and get NetFlow statistics

SimonBlackler — Wed, 16 Jul 2014 10:23:03 GMT

I've contacted ours re: FR780

Will let you know what they say when I hear back.

Re: Monitor subinterfaces and get NetFlow statistics

pulukas — Wed, 16 Jul 2014 21:40:52 GMT

Thanks hshah adding my vote too.

Re: Monitor subinterfaces and get NetFlow statistics

MMCiobanu — Wed, 16 Jul 2014 22:08:57 GMT

Thank you; on it, as well.

Re: Monitor subinterfaces and get NetFlow statistics

MMCiobanu — Wed, 16 Jul 2014 22:09:36 GMT

Thank you; voting as well.

Re: Monitor subinterfaces and get NetFlow statistics

SimonBlackler — Thu, 17 Jul 2014 09:45:38 GMT

So, according to our SE this feature isn't a priority and is currently not slated for any future release either.

This could be because PAN can't trivially (or otherwise) implement it because of the underlying architecture rather than not recognising it'd be very useful.

The current alternative, which is a bit of a hack and a lot of extra work in my opinion, is to use the API - https://live.paloaltonetworks.com/docs/DOC-5781

We're going to try this as this insight is essential to a subinterface deployment like ours.

I'll check back with our experiences and findings.

p.s The more people who can make noise about these FR's the better. So, ring your SE today!

Re: Monitor subinterfaces and get NetFlow statistics

SabreAce33 — Fri, 27 Mar 2015 15:44:01 GMT

Just to confirm, netflow via aggregates/sub-interfaces is supported in 6.0/6.1, but SNMP is still not supported, correct?

Re: Monitor subinterfaces and get NetFlow statistics

Retired Member — Wed, 08 Mar 2017 12:20:59 GMT

Hi,

panos 7.0 guide