VSX Netflow data pr. vs

[Kaland]

netflow‌vsx

Check Point VSX Netflow pr vs is not possible today. By design you only get netflow from vs0. 

This this is problematic for us as an MSP because we need to get netflow from customer dedicated vs only and to the customers SIEM and ELK system.  This is due most because of flow licensing in SIEM, and that we don´t want to give visibility to other customers netflow data.  

Does anyone have any experience with filtering this out in tools like ELK or nfdump?  Much appreciated  if anyone want to share and discuss here 

Check Point SK for Netflow 

NetFlow support by Gaia OS  - In the sk from Check Point  you can identify which vs id the flow is coming from

Hopefully Check Point will redesign this so you can set netflow settting pr. vs