Monitor subinterfaces and get NetFlow statistics

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Monitor subinterfaces and get NetFlow statistics

L3 Networker

Hi,

We have a PA-5020 and configured a few AGG interfaces with subinterface; recently, we installed a SolarWinds NTA to get NetFlow statistics, but I am not able to get anything from this device.

I have created a profile and applied to the subinterface through which the Internet traffic goes, but it does not send any information to the NetFlow collector.

agg.JPG.jpg

Also, is there a way we can monitor the AGG and subinterfaces using SNMP?

We do manage the device with SNMP through the management interface and I can see the physical interfaces, but not the AGG and subinterfaces.

Thank you very much.

1 accepted solution

Accepted Solutions

L6 Presenter

Hello MMC,

As long as I know Netflow/SNMP are allowed only on Physical Interfaces.

Please find bellow mentioned FR No.

Netflow on Sub interfaces FR#3058

SNMP on Sub interfaces FR#780


Regards,

Hardik Shah

View solution in original post

20 REPLIES 20

L7 Applicator

Hello MMCiobanu,

Could you please let me know the type of Netflow you have configured here.

With the exception of vendor specific variations of NetFlow, there are 2 different implementations of NetFlow:

  • Standard Netflow: The standard NetFlow implementation will collect all IP traffic information.
  • Sampled Netflow: Only 1 out of x packets is processed. For internet backbones is standard NetFlow to resource intensive, that's why they only collect samples instead of all the traffic.

The Palo Alto Networks firewall supports the standard NetFlow implementation.

Thanks

L7 Applicator

Hello MMCiobanu,


Prior to PAN-OS 6.0.0, NetFlow data could not be exported on a per-subinterface basis. Starting in PAN-OS 6.0.0, NetFlow data can be exported on a per-subinterface basis.


Bug 43280 - Exported Netflow Logs Aggregates Sub-interface Data

Thanks

It is standard netflow.

Will version 6 also enable monitoring AGG and subinterfaces? I believe, if the interface is not seen through SNMP from the device, the collector cannot get the Netflow information; not quite sure though.

Hello MMCiobanu,

PAN OS version 6.0.x will workfor monitoring AGG and subinterfaces.

Thanks

thank you very much; it looks like there are quite a few advantages to upgrade to 6.0

L3 Networker

we have upgraded to 6.0.3, still not able to monitor the AGG and subinterfaces

We're in the same boat.

I'm incredibly surprised that PANOS has got to version 6 without support for subinterfaces and AE bundles via SNMP?!

This is pretty critical stuff...

I agree that the snmp polling option really should be there.

The obvious work around is to pull the data from the connected port on the switch where other network vendors do give us this data.  (hint, hint to PA).

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

SNMP polling for tunnel interfaces would be good too!

Does anyone have the feature request numbers for these snmp updates?

FR####

I should send a vote off to my sales team while I'm thinking about it.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

L6 Presenter

Hello MMC,

As long as I know Netflow/SNMP are allowed only on Physical Interfaces.

Please find bellow mentioned FR No.

Netflow on Sub interfaces FR#3058

SNMP on Sub interfaces FR#780


Regards,

Hardik Shah

L1 Bithead

I've contacted ours re: FR780

Will let you know what they say when I hear back.

Thanks hshah adding my vote too.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
  • 1 accepted solution
  • 9255 Views
  • 20 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!