topic Re: Netflow IPSec in Firewall and Security Management

Netflow IPSec

handiansudianto — Thu, 22 Feb 2024 04:00:56 GMT

Hello,

I already configure the netflow on my checkpoint 5800 series and seem the netfow i working fine, i can see the checkpoint send the data to collector.

But when i check detailly why the netflow not send data if the destination located behind vpn site to site? I can see the checkpoint not send any data to our azure resource which using ipsec vpn site to site.

I do copy file from our onprem server to azure with private endpoint and capture the traffic using wireshark on collector server and found no data

Re: Netflow IPSec

the_rock — Thu, 22 Feb 2024 04:13:34 GMT

Is tunnel up? If yes, is this only thing thats failing?

Andy

Re: Netflow IPSec

handiansudianto — Thu, 22 Feb 2024 05:27:44 GMT

yes of course the tunnel is up, i generate the traffic by copy file from onprem to azure and this will pass thru vpn tunnel.

es, i can see all traffic to the tunnel no log on netflow

Re: Netflow IPSec

the_rock — Thu, 22 Feb 2024 13:45:06 GMT

Wait...to make sure we are on the same page here...are you saying that netflow traffic is actually going through the tunnel but you siomply canNOT see the log for it or am I totally mistaken when I say that?

Best,

Andy

Re: Netflow IPSec

the_rock — Thu, 22 Feb 2024 18:51:08 GMT

One good command you can also do is below

example, say src is 1.1.1.1, dst is 2.2.2.2, dst port is 4434...it would go src ip, scr port. dst ip, dst port, protocol

fw monitor -F "1.1.1.1,0,2.2.2.2,4434,0" -F "2.2.2.2,0,1.1.1.1,4434,0"

Best,

Andy

Re: Netflow IPSec

handiansudianto — Fri, 23 Feb 2024 01:43:17 GMT

Hi..

We can see log on the checkpoint firewall but not see on the netflow collector.

Re: Netflow IPSec

handiansudianto — Fri, 23 Feb 2024 01:44:04 GMT

The traffic is shown on the log, just on netflow collector the traffic is unseen by capturing using wireshark on the collector

Re: Netflow IPSec

the_rock — Fri, 23 Feb 2024 01:44:22 GMT

It might be simple fix as possibly restarting the collector...have you attempted so?

Best,

Andy

Re: Netflow IPSec

the_rock — Fri, 23 Feb 2024 01:45:09 GMT

Are you able to ping the fw from the collector itself?

Best,

Andy

Re: Netflow IPSec

handiansudianto — Fri, 23 Feb 2024 01:50:33 GMT

yes, actually the netflow is sending the data to the collector but i believe the netflow not send all traffic.

So i test by copy file from onprem to azure and the traffic not seen by collector, but if i test by browsing to the internet i can see the traffic on the collector.

Re: Netflow IPSec

the_rock — Fri, 23 Feb 2024 01:52:07 GMT

Only fails via vpn?

Re: Netflow IPSec

handiansudianto — Fri, 23 Feb 2024 02:02:46 GMT

Mostly yes, every day we have daily backup to azure and i not find this log on the collector. Usually on other firewall we can select netflow to be running on which interface, but i not see this on checkpoint. Are netflow on checkpoint will enabled on all interface including virtual interface like the tunnel?

Re: Netflow IPSec

the_rock — Fri, 23 Feb 2024 02:04:26 GMT

Well, what interface is it enabled on?

Andy

Re: Netflow IPSec

handiansudianto — Fri, 23 Feb 2024 02:07:17 GMT

You can see on the pic we cant select on which interface will be enabled

Re: Netflow IPSec

the_rock — Fri, 23 Feb 2024 02:30:00 GMT

Apologies, its been some time since I did this, you are 100% right, just checked it in my lab. Sorry mate, not sure at this point, maybe better have TAC case open, might be worth remote session to check further.

Best,

Andy

Re: Netflow IPSec

handiansudianto — Fri, 23 Feb 2024 02:34:03 GMT

did you mean checkpoint netflow have some missing data or we can't selech on which interface netflow can be enabled?

Re: Netflow IPSec

the_rock — Fri, 23 Feb 2024 02:37:15 GMT

I dont believe there is missing data, looks right to me. No, you cant select the interface...k, silly ?, but did you make sure netflow collector is part of the enc domain?

Andy

Re: Netflow IPSec

the_rock — Fri, 23 Feb 2024 02:53:28 GMT

You can also verify it via clish -> show netflow and then tab for all the options

Re: Netflow IPSec

handiansudianto — Fri, 23 Feb 2024 03:59:53 GMT

Here the result

show netflow all

Fw rule: No
Address Port Format Src Addr Enable
10.103.248.55 2055 IPFIX 10.103.253.10 yes

show netflow collector

Collector IP Address 10.103.248.55
Collector UDP Port 2055
Export Format IPFIX
Source Address 10.103.253.10
Enabled yes

show netflow fwrule

FW rule: No

Re: Netflow IPSec

the_rock — Fri, 23 Feb 2024 04:02:36 GMT

Seems fine. Did you make sure collector is part of the end domain?

Andy