topic Re: VSX Netflow data pr. vs in Firewall and Security Management

VSX Netflow data pr. vs

Kaland — Tue, 20 Feb 2018 09:42:37 GMT

netflow‌vsx

Check Point VSX Netflow pr vs is not possible today. By design you only get netflow from vs0.

This this is problematic for us as an MSP because we need to get netflow from customer dedicated vs only and to the customers SIEM and ELK system. This is due most because of flow licensing in SIEM, and that we don´t want to give visibility to other customers netflow data.

Does anyone have any experience with filtering this out in tools like ELK or nfdump? Much appreciated if anyone want to share and discuss here

Check Point SK for Netflow

NetFlow support by Gaia OS - In the sk from Check Point you can identify which vs id the flow is coming from

Hopefully Check Point will redesign this so you can set netflow settting pr. vs

Re: VSX Netflow data pr. vs

PhoneBoy — Fri, 23 Feb 2018 20:05:48 GMT

Not familiar with a way to do this, but maybe someone else has.

Can see why this would be a useful feature to have.

Re: VSX Netflow data pr. vs

Kaland — Fri, 11 Jan 2019 07:43:56 GMT

Hi,

Does this mean that this have been implemented? do you have some more information about this that you can share?

Best regards

Bjørn Andre Kaland

Re: VSX Netflow data pr. vs

PhoneBoy — Fri, 11 Jan 2019 08:36:22 GMT

That's what it appears to mean, but unfortunately I don't have details.

If it's of interest to you, I recommend getting involved in the EA.

Re: VSX Netflow data pr. vs

Magnus-Holmberg — Mon, 08 Jun 2020 17:24:38 GMT

Any update on this, netflow per vs would be perfect

Re: VSX Netflow data pr. vs

Maarten_Sjouw — Tue, 09 Jun 2020 06:59:20 GMT

The feature that has been added is that it now adds a VS-ID to the netflow packets, so to support this your netflow system should be able to recognise this ID and show the data per VS.

Re: VSX Netflow data pr. vs

Magnus-Holmberg — Tue, 09 Jun 2020 12:53:58 GMT

Sure and thats good.
But as an MSP i would like to configure one netflow system per VS as each VS belongs to a diff customer, and these customer do not always buys our service they just want the data so to say.

Similar to SNMP where i can configure diff users to be able to poll, and then allow them to poll the specific VS on its IP.

Re: VSX Netflow data pr. vs

ivanmarkovic — Thu, 21 Jan 2021 07:44:48 GMT

Hi there,

Is there maybe any tutorial how to do it.

I am using opmanager and as soon as i set netflow on any of the VSX or physical box i get flow from the VSX cluster and data seems bogus.

Regards, Ivan