Monitor subinterfaces and get NetFlow statistics

[MMCiobanu]

Hi,

We have a PA-5020 and configured a few AGG interfaces with subinterface; recently, we installed a SolarWinds NTA to get NetFlow statistics, but I am not able to get anything from this device.

I have created a profile and applied to the subinterface through which the Internet traffic goes, but it does not send any information to the NetFlow collector.

Also, is there a way we can monitor the AGG and subinterfaces using SNMP?

We do manage the device with SNMP through the management interface and I can see the physical interfaces, but not the AGG and subinterfaces.

Thank you very much.

[MMCiobanu]

Thank you; on it, as well.

[MMCiobanu]

Thank you; voting as well.

[SimonBlackler]

So, according to our SE this feature isn't a priority and is currently not slated for any future release either.

This could be because PAN can't trivially (or otherwise) implement it because of the underlying architecture rather than not recognising it'd be very useful.

The current alternative, which is a bit of a hack and a lot of extra work in my opinion, is to use the API - https://live.paloaltonetworks.com/docs/DOC-5781

We're going to try this as this insight is essential to a subinterface deployment like ours.

I'll check back with our experiences and findings.

p.s The more people who can make noise about these FR's the better. So, ring your SE today!

[SabreAce33]

Just to confirm, netflow via aggregates/sub-interfaces is supported in 6.0/6.1, but SNMP is still not supported, correct?

[panos]

Hi,

panos 7.0 guide

[nextgenhappines]

The SNMP counter for logical interface is reporting incorrect values,

This is what I got back from TAC,

For hardware interfaces (ethernet1/21 and ethernet1/22), we only populate ""Physical port counters read from MAC" in the SMNP MIB.

These are MAC counters at the physical interface level.

For logical interfaces (AE1), we only populate "Hardware interface counters read from CPU" in the SNMP MIB.

As we do not actually have a physical interface for AE1, the MAC counters at physical level are not applicable here. We will only look for the Hardware CPU counters here.

Because most of the packets never reach the CPU as they are offloaded, we don't see a significant increment in the Hardware CPU counters.

As the counters on the hardware interfaces and the logical interfaces use different types of counters, it is not appropriate to compare the values on HW interfaces and Logical interfaces.