topic Re: netflow not show data in Firewall and Security Management

netflow not show data

kobilevi — Tue, 02 Feb 2021 14:25:32 GMT

hello

i try to check peak of data by netflow protocol

i have 2 gateways in cluster -Active\Passive

i config the gateway notflow setting as :

****add netflow collector ip XXXXX port 9991 export-format Netflow_V5

***"show netflow collector" show :

Collector IP Address XXXX
Collector UDP Port 9991
Export Format Netflow_V5
Enable yes

"fw ctl zdebug" drop | grep (XXXX-{the ip of collector})----dont see any drops

i check double my netflow server setting and everything looks ok....

i check in another server of netflow and i dont see any data again

can some one help?

**i check the port is enable and accept,

i see traffic on port 9991 in the the log....

Tanks

Re: netflow not show data

PhoneBoy — Tue, 02 Feb 2021 20:37:56 GMT

Are you seeing no netflow data, only seeing some netflow data, or?
Is SecureXL enabled? (This is required for Netflow)
Also, I think our Netflow implementation only sends data once the connection is closed.

Re: netflow not show data

Maarten_Sjouw — Wed, 03 Feb 2021 05:58:10 GMT

From R80.20 on to be able to get Netlow data you need to enable accounting on top of log for the rules you want the netflow data.

We ran into this issue last wek after upgrading a gateway from R80.10 to R80.30