Problem with multiple Netflow profiles

[lavision]

Hello,

I encounter a problem using multiple netflow profiles on our PA-500 running PAN-OS 4.1.8

I have defined 3 different neflow profiles, each refers to a specific port on the same host.

Each profile is assigned to exactly one physical layser 3 interface.

The first profile delivers reasonable data to my flow receiver (Paessler PRTG Network Monitor), but the two other profiles dont seem to work.

The corresponding monitor channel simply gets no data.

Anybody has a hint how to resolve this problem?

Thanks,

dweide

[sdurga]

Try restarting log rcvr process with this command

debug software restart log-receiver

If that does not work then remove the netflow profile on the interface that is working and apply netflow profile only to the interfaces that are not working and run the below command to see whether PAN is exporting any kind of netflow records for these interfaces.

debug log-receiver netflow statistics

Also, what kind of interfaces are these tunnel, Vlan, Loopback, Sub-interfaces or regular L2 , L3 interfaces ? Which software version ?.

Also, Can you apply the Netflow profile which is working to other two interfaces that are not working and see if you are receiving any data on the Netflow server ? This is to rule out the issues on the Netflow server side.

[lavision]

Dear sdurga,

thanks for your debugging hints!

Restarting the process didnt fix the problem.

I reassigned the netflow profiles as suggested and found that everything is working fine as long as I use only one profile:

• cli shows that netflow packets are sent at reasonable rate(debug log-receiver netflow statistics)
• netflow data is send on the correct port defined in the profile (proved by the fact that the receiver is display the flows in the correct channel)
• each profile alone works on each interface

The situation changes if I assign a second profile to one of my L3 interfaces:

• netflow receiver gets only data for one interface
• cli statistics shows that the second netflow profile is only generating data for each timeout interval (i.e. one packet each 5 minutes)
• it seems that data is only generated for the lowest interface number

All interfaces are plain L3 type on the same virtual router. Software version is 4.1.8

Regards,

Detlev Weide

[sdurga]

So if I am not wrong only one Netflow profile will work at a time. Adding another (second) Netflow profile simultaneously to another Interface will not work. This is not expected behavior, please open a ticket with support. In the mean while I will try to see on my device if I am also seeing the same behavior.

Thanks,

Sandeep T

[lavision]

I opened a case and my problem seems to be reproducable.

I will post an update as soon as I get a fix.

[lavision · Accepted solution]

I updated to 5.0.0 and all Netflows work now.