How to configure NetFlow on Palo Alto firewalls

These instructions assume:

• The date, time and time zone are correctly set on the firewall.
• You have administration access to the Palo Alto dashboard.
• The IP address of your Auvik collector is known.

If you are using a shared collector and want TrafficInsights to associate flow data with the correct site, you must add the source IP address as a dedicated /32 network within Auvik.

For example:

192.168.1.10/32

Even if the source IP address is already included in a larger monitored subnet, a dedicated /32 entry is required for TrafficInsights to correctly associate flow records with the appropriate site.

After making this change, it may take several minutes before flow data appears in TrafficInsights.

Access the Palo Alto web interface

1. Open a web browser and type in the IP address of the Palo Alto firewall.
2. Log into your firewall.

Create a NetFlow server profile

1. Select Device > Server Profiles > NetFlow and click Add.
2. Enter TrafficInsights as the name for the profile.
3. Set the default Template Refresh Rate to 5 minutes and 20 packets.
4. For the Active Timeout, set the value at 1 minute.
5. Select the checkbox for the PAN-OS Field Types.
6. For each NetFlow collector section, click Add.
   1. Name: TrafficInsights
   2. Server: <Auvik Collector IP>
   3. Port: <2055, 2056, 4432, 4739, 6343, 9995 or 9996>
7. Click Okay.

Assign the NetFlow server profile

The steps below specify a LAN interface for collecting NetFlow data. For a different interface, choose your desired interface in step 2.

1. Select Network > Interfaces > Ethernet.
2. Click a LAN interface to edit it.
3. In the NetFlow Profile drop-down, select the TrafficInsights server profile.
4. Click Okay.