Create a Post
Showing results for 
Search instead for 
Did you mean: 

Netflow, does it show Ingrees and Egrees?

Hello Check Mates, 

perhaps a silly question, and perhaps a total application dependend question:
We configured Netflow V9 on some gateways, we collect data in PRTG, pretty simple stuff, it has not many features.
But it show all together in "one graph". OK

The customer said its not sufficient, he wants to measure the bits and bytes going through the firewalls. and not just simple bytes but also SRC & DST and services.
The tool we had was HPE IMC, we setup Netflow and wondered, it show all data in Ingrees graph, all data is in the inbound path.
The Outbound path is empty.


So iam asking myself, a rookie in Netflow, is this by design? Or is Check Point lacking some Netflow parameters?
Or is it a HP IMC related issue?
It seems all traffic which we produced is inside our Inbound graph ... so nothing is missing.

Sofware is R81 + Take 58 (Clean Install)
All rules without Accounting! Here the documentation is very contradictory

You performed a Clean Install of R81

  • By default (value 1) the NetFlow export is enabled for traffic accepted by all Access Control rules.
  • You can configure the value 0 to enable the NetFlow export only for traffic accepted by Access Control rules with the Track option Log and Accounting you configured in SmartConsole.


Important - If you configure the value 0, you must configure the applicable Access Control rules in SmartConsole.


0 -> Access Control rules with the Track option Log and Accounting

1 -> enabled for traffic accepted by all Access Control rules


But the CLI says:

SSPFW01> show netflow fwrule

FW rule: 1 (NetFlow exports its records only for traffic accepted by Access Control rules configured in SmartConsole with the 'Track' option 'Log' and 'Accounting'

SSPFW01> show netflow fwrule

FW rule: 0 (NetFlow exports its records for traffic accepted by all Access Control rules)


perhaps somebody is expert here.

best regards

0 Kudos
5 Replies
This widget could not be displayed.