topic Issues with netflow. in General Topics

Issues with netflow.

system_admin — Mon, 14 May 2012 21:53:44 GMT

We are having issues getting our information from our PaloAlto 5020's. It looks like it is sending but we do not have any chartable information on either of our netflow servers. We are using Solarwinds Netflow Traffic Analyzer as well as What's up gold flow analyzer. Palo Alto says that I have setup the server profile and applied it to the interfaces properly. I would just like to get someone else opinion on this. It seems that anything that is reporting on Netflow version 9 is giving this issue. Any help is greatly appreciated.

Re: Issues with netflow.

UhMayYeah — Fri, 18 May 2012 00:27:09 GMT

Generally following error messge is seen on the Orion NTA:

*Error Message on The Orion Netflow Traffic Analyzer :

NetFlow Receiver Service [US-HEN-ORION01] is receiving NetFlow data from an unmanaged interface on PA-5050. The NetFlow data will be discarded.

*PA firewall sends out these fields INPUT_SNMP and OUTPUT_SNMP which are used by Orion NTA to analyze the Netflow data as per the Orion NTA Admin Guide just with different names InputInt and OutputInt but matching indices as per the RFC 3954.

* This is also being checked with Solaris Engineering if this could cause some knd of incompatibilty.

I will update this discussion once I have some more info.

Re: Issues with netflow.

system_admin — Thu, 21 Jun 2012 16:26:33 GMT

The fix for this issue is slated for OS 4.1.7 which should be available by the end of June. This is from Palo Alto engineers.

Re: Issues with netflow.

mikand — Thu, 21 Jun 2012 17:04:29 GMT

Theres a great article in the knowledgebase regarding this:

(id 36257, Some data being sent to Netflow connector is in the wrong format.)

Re: Issues with netflow.

roundisfunny — Mon, 06 Aug 2012 14:50:09 GMT

I applied the update to 4.1.7 and am still getting no byte counts when I look at Netflow conversations in Whatsup Gold. I tried deleting the PA as a Netflow source and adding it back as well as I recreated the Netflow profile on the PA but neither fix seemed to work. Is there something else I need to do?

Re: Issues with netflow.

SShnap — Wed, 16 Aug 2017 21:53:44 GMT

Hi you need to go under

Device tab - Setup - Services Features - Service route configuration

change it to Customize and change Netflow and SNMP trap to the specific interface.

that should work.

Good Luck