topic No Netflow on 4000 Series in General Topics

No Netflow on 4000 Series

forfarj — Sat, 24 Mar 2012 13:09:55 GMT

I was looking into setting up Netflow exports on my 4020 and noticed that the Admin Guide states that Netflow is supported on all but the 4000 series. Can anyone shed some light as to why?

Justin

Re: No Netflow on 4000 Series

sspringer — Sat, 24 Mar 2012 18:35:41 GMT

Hi Justin,

I was not able to find much detail on the technical reason and if you require such detail I would suggest opening a case. I have been able to confirm there are no plans to implement Netflow on the 4000 series as it does not have the capability to gather the flow-based stats required for Netflow.

- Stefan

Re: No Netflow on 4000 Series

mikand — Sat, 24 Mar 2012 18:54:02 GMT

The technote for Netflow-Fields.pdf says the same thing:

Overview
PAN-OS can generate and export Netflow Version 9 records with unidirectional IP traffic flow information to an outside
collector. Netflow export can be enabled on any ingress interface in the system. Separate template records are defined for
IPv4, IPv4 with NAT, and IPv6 traffic, and PAN-OS specific (enterprise specific) fields for App-ID and User-ID can be
optionally exported. This feature is available on all platforms, except the PA-4000 Series. For more information about
Netflow, refer to the Palo Alto Networks Administrator’s Guide.

It would be interresting to get a comment from PAN why the 4000-series is lacking the netflow option?

My best guess is that 2000-series and below uses FPGA which PAN can programme themselfs on how they should operate while 4000-series uses ASIC which didnt include the netflow feature - but this is just a guess.

If this is correct, does the 5000-series use an ASIC or FPGA (and does the 5000-series support Netflow)?

Re: No Netflow on 4000 Series

jseals — Sun, 25 Mar 2012 04:43:16 GMT

Hi Mikand,

I'm not sure of the logistics behind the unavailability for netflow on the 4k appliances just yet either, but I do know the 5000 appliances support Netflow.

Jason Seals

Re: No Netflow on 4000 Series

rmonvon — Mon, 26 Mar 2012 20:43:45 GMT

Hi...The 4000 series was introduced in 2007 and its hardware lack the required resource to implement Netflow. Unfortunately, we cannot remedy this.

Thanks.