topic Re: Netflow data - How often is it exported to a collector and.. in General Topics

Netflow data - How often is it exported to a collector and..

LShelton — Tue, 09 Feb 2016 14:05:36 GMT

Our firewall is setup to export Netflow data to Nagios Network Analyzer. We need to know:

a) How often is data exported from the Palo Alto to the NNA collector, and

b) How large are the packets sent from the Palo to the collector

Any ideas on where to find this information?

Re: Netflow data - How often is it exported to a collector and..

pankaku — Tue, 09 Feb 2016 14:18:02 GMT

The frequency of the net flow export can be configured by "Active Timeout" under the netflow profile.

Active Timeout is the frequency in minutes at which the firewall exports records (default is 5).

Check the following document:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Netflow-Server-Profile-and-Assign-to-Interface/ta-p/57367

Re: Netflow data - How often is it exported to a collector and..

pankaku — Tue, 09 Feb 2016 14:20:16 GMT

check the following admin guide for more information. In the PDF search for "NetFlow Monitoring"

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os.html

Re: Netflow data - How often is it exported to a collector and..

LShelton — Tue, 09 Feb 2016 14:25:48 GMT

Sweet thanks for that!! When I first read that before posting it sounded like the Active Timeout was what I was looking for. As for the size of the netflow data sent at the Active Timeout interval, is that the setting of "Packets" under "Template Refresh Rate?"

Re: Netflow data - How often is it exported to a collector and..

pankaku — Tue, 09 Feb 2016 14:27:52 GMT

Template Refresh Rate is different then the packet size. You can do pacps on the firewall to check the packet size.

Hope this helps.

Re: Netflow data - How often is it exported to a collector and..

LShelton — Tue, 09 Feb 2016 14:37:19 GMT

So when the Palo sends the data to the collector every minute, it's just a single packet?

Re: Netflow data - How often is it exported to a collector and..

pankaku — Tue, 09 Feb 2016 15:34:28 GMT

Not sure about the size it may vary. Firewall may send multiple packets. Check the screenshot i have attached. The screenshot is from a firewall sending the netflow packets to netflow server.

Re: Netflow data - How often is it exported to a collector and..

pankaku — Tue, 09 Feb 2016 17:50:43 GMT

We can use the following command for some statististics:

debug log-receiver netflow statistics