topic VSX Netflow per VS in Firewall and Security Management

VSX Netflow per VS

Fung_To_Puk — Tue, 27 Jul 2021 03:21:07 GMT

I just tested in lab VSX Netflow with R81 and R81.10 VSX gateway and notice there is a different behaviour between 2 versions.

On R81 VSX gateway, I could sent out netflow per VS with its own IP as source address (verified by wireshark on the collector).

On R81.10 VSX gateway, it is reverted to same behaviour as R80.40 that all netflow is sent by VS0, if VS0 does not have any route to go out, then no netflow can be received by the collector.

Anybody could confirm which behaviour is final? or there are specific procedure for R81.10 to make it same as R81?

Re: VSX Netflow per VS

PhoneBoy — Tue, 27 Jul 2021 07:28:41 GMT

One of two possibilities:

R81 had the incorrect behavior
This was "fixed" in R81 but was regressed in R81.10

This SK suggests the first one is probably the case: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102041
Regardless, I recommend a TAC case.

Re: VSX Netflow per VS

Fadi_Moussa — Tue, 27 Jul 2021 08:36:25 GMT

Hi,

What you are seeing in R81.10 is the correct behavior. Traffic should be leaving through VS0 instead of the VS itself. This is also described in https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102041

However, in R81 there was a bug that traffic was sent per VS with its own IP as source address. This bug is already solved and will be released in a Jumbo HF version soon.

Thanks,

Fadi

Re: VSX Netflow per VS

Fung_To_Puk — Tue, 27 Jul 2021 08:51:40 GMT

That's too bad.

Actuall,y why not let each VS sent netflow on its own? This is what most customer would expect and requested as usually each VS belong to different network which is not accessible (also not allowed) through VS0.

I know some may suggest adding a virtual switch then all VS and VS0 conenct to that switch which would make the netflow able to sent from VS0, but that is explicitly forbidded as each VS belong to different customer/administrator.

Re: VSX Netflow per VS

Fadi_Moussa — Tue, 27 Jul 2021 09:05:20 GMT

Hi,

I understand your concern.

I will take it internally with R&D to see if we can develop something else for future releases.

Re: VSX Netflow per VS

sravanan17 — Mon, 12 Feb 2024 13:42:32 GMT

Hi Fadi,
I would like to know if you have got any update or latest news on this topic.

Thanks,
Saravana

Re: VSX Netflow per VS

Chris_Atkinson — Mon, 12 Feb 2024 15:53:42 GMT

There are VSX changes coming with R82 but not sure about Netflow specifically.

Please follow this up with your local SE to confirm and ensure it is supported by RFEs.

Re: VSX Netflow per VS

_Val_ — Tue, 13 Feb 2024 09:04:45 GMT

If you need a specific enhancement related to this topic, please raise an RFE through the standard channels.

Re: VSX Netflow per VS

sravanan17 — Tue, 13 Feb 2024 09:09:14 GMT

Hi Chris,
Thanks for your response, noted.

Regards,
Saravana