Netflow

[handiansudianto]

Hello,

We using solarwinds NTA to capture traffic conversation, but i can see the conversation for my checkpoint is from public ip to public ip. What can we do on checkpoint side so netflow only send conversation from client ip address (not natted ip address) to the internet?

[PhoneBoy]

The IP addresses and TCP/UDP ports reported by NetFlow are the ones on which it expects to receive traffic.
Therefore, for NATed connections, one of the two directions of flow is reported with the NATed address.
This is, therefore, expected behavior.
See: https://support.checkpoint.com/results/sk/sk102041