https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132534#M19651 <P>Hello Chris,</P><P>yes, Log and Accounting are enabled for all rules.</P><P>We have already compared this problem GW with other - the config is the same. It is not something special, you just enable it, specify the collector and activate for a rule.</P> Mon, 25 Oct 2021 08:27:56 GMT Exonix 2021-10-25T08:27:56Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132429#M19615 <P>Hello,</P><P>we have several firewalls (version 80.40) and we have configured them to send Netflow to some SIEM. We receive logs from almost all gateways except one. After investigation, we found that Netflow traffic does not contain any useful information.</P><P>How can we troubleshoot this?</P><P>Thank you in advance.</P> Fri, 22 Oct 2021 12:51:20 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132429#M19615 Exonix 2021-10-22T12:51:20Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132477#M19627 <P>How are the rules/policy configured for the troublesome gateway?</P> <P>In the Track column for rules, you must select Log and Accounting.</P> Sat, 23 Oct 2021 15:39:47 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132477#M19627 Chris_Atkinson 2021-10-23T15:39:47Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132478#M19628 <P>Chris makes a good point. I would personally also compare to see if there are any differences among that specific gateways and the other ones that would potentially cause this issue.</P> Sat, 23 Oct 2021 18:39:54 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132478#M19628 the_rock 2021-10-23T18:39:54Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132534#M19651 <P>Hello Chris,</P><P>yes, Log and Accounting are enabled for all rules.</P><P>We have already compared this problem GW with other - the config is the same. It is not something special, you just enable it, specify the collector and activate for a rule.</P> Mon, 25 Oct 2021 08:27:56 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132534#M19651 Exonix 2021-10-25T08:27:56Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132537#M19653 <P>Noted. For additional context could you please share the model of gateway and installed JHF version?</P> Mon, 25 Oct 2021 09:21:28 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132537#M19653 Chris_Atkinson 2021-10-25T09:21:28Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132549#M19657 <P>Not sure in that case, might be worth contacting TAC and troubleshooting further.</P> Mon, 25 Oct 2021 13:10:08 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/132549#M19657 the_rock 2021-10-25T13:10:08Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/133300#M19823 <P><SPAN>Hello Chris, I hope you asked about this:</SPAN></P><P>Product Name: VMware Virtual Platform<BR />Product Name: 440BX Desktop Reference Platform</P><P>HOTFIX_R80_40_JUMBO_HF_MAIN Take: 94<BR />BUNDLE_R80_40_JUMBO_HF_MAIN Take: 94</P> Fri, 05 Nov 2021 11:55:41 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Netflow-is-empty/m-p/133300#M19823 Exonix 2021-11-05T11:55:41Z