topic IPFIX vs Netflow in Firewall and Security Management

IPFIX vs Netflow

C_M — Fri, 07 Feb 2020 22:23:21 GMT

Which is recommended for Check Point?

Also, how memory/CPU intensive is it?

Any difference for VSX and non-VSX?

PhoneBoy — Sun, 09 Feb 2020 04:28:36 GMT

The reason we support IPFIX and Netflow v5/v9 is because different customers have different collectors.
From a Check Point perspective, there isn't a specific recommendation to use one over the other as it's all provided from the same infrastructure.
The CPU overhead of either choice is fairly minimal.
VSX is definitely supported in R80.x releases and the VS # is communicated in the various records.
See also: https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk143032

C_M — Mon, 10 Feb 2020 18:35:35 GMT

Do you know what the default active flow timeout is on Check Point firewalls for IPFIX? I didn't see it in the setup document on sk102041.