topic Re: netfow seems broken on 1500 in Spark Firewall (SMB)

netfow seems broken on 1500

John_Fleming — Sat, 08 Feb 2020 04:21:24 GMT

i enabled netflow to send data to an elk stack instance. Nothing showed up. Ran a packet capture.. nothing in capture..

netstat -an | grep 2055 ...nada

did a strace on the netflow process and i see over and over

9984 openat(AT_FDCWD, "/proc/ppk/netflow-conf", O_RDWR) = -1 ENOENT (No such file or directory)

which for sure doesn't exist. Sad panda, case opened. Oh and yes I rebooted after turned on netflow.

Re: netfow seems broken on 1500

Chris_Atkinson — Sat, 08 Feb 2020 10:42:08 GMT

Per sk159772 it should be supported, which version/build are you running?

Re: netfow seems broken on 1500

John_Fleming — Sat, 08 Feb 2020 15:42:01 GMT

This is Check Point's 1550 Appliance R80.20.01 - Build 909 - this is to fix the kernel panic in the other thread.

I noticed some extra config options opened up now and I don't understand what they do. The docs are good enough to tell me the arguments are IP and port. That cleared up a lot.

set netflow collector for-ip x.x.x.x for-port 2055

I have no idea what a for-ip and for-port is but it seems to auto fill with the collector ip and port. ¯\_(ツ)_/¯

Re: netfow seems broken on 1500

G_W_Albrecht — Tue, 11 Feb 2020 15:02:20 GMT

Did you configure the net flow collector following SMB 1500 Appliance Series R80.20.01 CLI Reference Guide p.627ff ?

Re: netfow seems broken on 1500

Amir_Erman — Tue, 11 Feb 2020 15:06:40 GMT

Indeed, this is broken on 15xx; We suspect similar issue on other releases

We are working to fix it

Thanks

Amir

Re: netfow seems broken on 1500

John_Fleming — Mon, 24 Feb 2020 22:50:22 GMT

Hot off the presses.

Netflow support is indeed broken and the support page is going to be updated to reflect Netflow being unsupported on R80.20 Gaia Embedded.

It is planned to be fixed but there is no ETA. At least I wasn't told to go RFE myself so hurrah for that.

Re: netfow seems broken on 1500

HristoGrigorov — Tue, 25 Feb 2020 06:04:18 GMT

That is very disturbing news actually 😟

Re: netfow seems broken on 1500

Liran_H — Wed, 01 Sep 2021 09:51:42 GMT

Is there any update regarding this issue?

Re: netfow seems broken on 1500

_Val_ — Wed, 01 Sep 2021 10:49:09 GMT

@John_Fleming where this info coming from? sk159772 says Netflow is supported on R80.20.x with the only limitations related to CLI config.

Re: netfow seems broken on 1500

_Val_ — Wed, 01 Sep 2021 10:49:51 GMT

Netflow is supported on Gaia SMB R80.20.x versions and can be configured via CLI only