Does anyone know what the netflow sample rate is on PA5000 series? Is it 1 to 1 or 1 to 50?

[atorrado]

We are sending netflow traffic to our SIEM and wanted to know is what the sample rate if there is one on our 5060s.  We have to gage our SIEM retention based on flows per second.  We are putting in more 5060s and trying to figure out how much netflow traffic would be sent there.

[UhMayYeah]

I don't think PA firewalls support sampling rate for Netflow .

Sampling Rate was a introduced by Cisco and is also configurable on Juniper Firewalls.

Following configurable factors govern how/when the Netflow records are exported to the Netflow Collector:

#Template Refresh Rate:

Minutes : No.  of packets after which the Netflow template is refreshed . (default 30 min,range 1-3600)

OR

Packets : No.  of packets after which the Netflow template is refreshed. ( default 20 ,range 1-600)

#Active Timeout

Frequency at which data records are exported for each session (minutes).(Def-5 max 60)

Netflow stats can be viewed from the CLI using the following CLI command:

>debug log-receiver netflow statistics

HTH