Netflow data - How often is it exported to a collector and..

[LShelton]

Our firewall is setup to export Netflow data to Nagios Network Analyzer.  We need to know:

a)  How often is data exported from the Palo Alto to the NNA collector, and

b)  How large are the packets sent from the Palo to the collector

Any ideas on where to find this information?

[pankaku]

The frequency of the net flow export can be configured by "Active Timeout" under the netflow profile.

Active Timeout is the frequency in minutes at which the firewall exports records (default is 5).

Check the following document:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Netflow-Server-Profile-...

[pankaku]

check the following admin guide for more information. In the PDF search for "NetFlow Monitoring"

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os.html

[LShelton]

Sweet thanks for that!!  When I first read that before posting it sounded like the Active Timeout was what I was looking for.  As for the size of the netflow data sent at the Active Timeout interval, is that the setting of "Packets" under "Template Refresh Rate?"

[pankaku]

Template Refresh Rate is different then the packet size. You can do pacps on the firewall to check the packet size.

Hope this helps.

[LShelton]

So when the Palo sends the data to the collector every minute, it's just a single packet?

[pankaku]

Not sure about the size it may vary. Firewall may send multiple packets. Check the screenshot i have attached. The screenshot is from a firewall sending the netflow packets to netflow server.

[pankaku]

We can use the following command for some statististics:

 debug log-receiver netflow statistics