How to Configure Netflow Server Profile and Assign to Interface

Steps

The following steps describe how to configure the Netflow Server Profile:

1. Go to Device > Server Profiles > Netflow
2. Click Add to bring up the Netflow Server Profile
3. Add a Name for the Netflow settings
4. Click Add and fill the Name (name to identify the server) and Server (host name or IP address of the server) field
5. The port is automatically populated as 2055, but can be edited if needed, as shown below:
   

The profile can be assigned to an existing Palo Alto Networks firewall interface, so that all traffic flowing over that interface is exported to the specified server above.

To assign the profile created above to the interface, follow the steps below:

1. Click on Network > Interfaces, go to either Ethernet, VLAN, Loopback or Tunnel tabs
2. Select any interface and assign the above created Netflow Server Profile ( Netflow_Profile1) in the Netflow Profile field:
   

Commit changes

Note : (Required for PA-7000 Series and PA-5200 Series firewalls) Configure a service route for the interface that the firewall will use to send NetFlow records.

You cannot use the management (MGT) interface to send NetFlow records from the PA-7000 Series and PA-5200 Series firewalls. For other firewall models, a service route is optional. For all firewalls, the interface that sends NetFlow records does not have to be the same as the interface for which the firewall collects the records.
 

1. Select Device>Setup>Services
   1. (Firewall with multiple virtual systems) Select one of the following: Global or Virtual Systems
2. Select Service Route Configurations and Customize
3. Select protocol IPv4 or IPv6
4. Click Netflow
5. Select the Source Interface 
   1. Any, Use default, MGT are not valid interface options for PA-7000 and PA-52000 Series firewalls
6. Select a Source Address IP
7. Click OK twice