Performance impact when enabling NetFlow?

[Tim_Koopman]

I am wondering what is the performance impact of enabling NetFlow?

And how does that compare to normal Logging from a performance point of view?

I have some large gateways and we required currently to log all traffic both allowed and blocked. On our bigger firewalls this is starting to cause problems as the FWD process that handles all logging is single threaded so while we have followed the best practice and given it a dedicated CPU core that is still not enough. The FW worker process are not even at 50% so firewall can handle more but logging often goes to local logging only.

Our log servers themselves are running fine it is just the FWD logging process causing a bottleneck.

I am thinking if NetFlow has less of an impact on the CPUs or even if the same impact but spread over multiple CPUs then I may be able to suggest we change to only logging more important entries and use NetFlow for the rest.

Any data around this would be appreciated.

Tim

[PhoneBoy]

My understanding is that Netflow:

• Relies on SecureXL
• Only sends traffic handled by SecureXL and friends (includes Medium Path)
• Only sends updates every 30 minutes or so

As such I would not expect it to have a huge performance impact.