topic Re: Netflow - firewallEvent in General Topics

Netflow - firewallEvent

evanskie — Thu, 29 Jun 2017 22:05:26 GMT

Hi,

what does the content of the firewallEvent field mean? Is there a better documentation than this document?

-> https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-logging/netflow-templates

Especially what is the difference between "Flow created" and "Flow deleted"?

Is "Flow created" a flow with a duration shorter than a defined timeout and "Flow deleted" a very short-lived flow?

"Flow updated" seems to be a long lasting flow exported in separate parts, but the document states:

"the session state changed from active to deny". I am unsure about that.

When would "Flow alerted" be generated? It never pops up in my collector software.

Re: Netflow - firewallEvent

BPry — Thu, 29 Jun 2017 22:41:22 GMT

@evanskie,

I think this would likely make more sense if it just called 'flow' what it trully is refering to, a session. I could be wrong on that though.

If I'm right that would make it essentially be

1 = Flow created

2 = Flow deleted

3 = Flow denied

4 = Flow alert

5 = Flow update

Would actually mean

1) Session Created

2) Session Deleted.

3) Session Denied.

4) ? If I would have to guess I would say this triggers if a DoS profile is tripped, I would have to test this out to be sure though.

5) Session switched from Active to Drop due to something like an applicaiton change.

The document is included in all of the 7.1 administration guides and I would assume 8.0 as well, but no further description was provided in the 7.0 and 7.1 administration guides when I looked.

Re: Netflow - firewallEvent

evanskie — Fri, 30 Jun 2017 07:59:41 GMT

Thanks for your reply.

From my understanding a unique flow is determined by the tuple SRC-Ip/SRC-Port and DST-Ip/DST-Port.

I analyzed the flow data in my environment (ELK-Stack) and there are only entries of unique flows which are tagged either with "Flow create" or "Flow deleted". So there must be an other explanation for that.

For "Flow update" I can see multiple entries for the same flow exported about every 15 minutes (long lasting SSH-Connections).

"Flow denied" is clear: this flow was dropped by the firewall.

Someone else some ideas?