How to configure NetFlow on Palo Alto firewalls

These instructions assume:

• The date, time and time zone are correctly set on the firewall.
• You have administration access to the Palo Alto dashboard.
• The IP address of your Auvik collector is known.

If you have a shared collector and want to ensure that it receives netflow data to enable TrafficInsights, you will need to add the source IP address as a /32 in order for Auvik to register the flows from that specific address in the TrafficInsights portal. There may be some delay for the shared collector to receive the data after the change.

Note: Even if that source IP address is already being scanned, you must add a /32 targeting only the source IP address, due to some limitations, the collector can’t tell if it should be sent to site A or B.

Access the Palo Alto web interface

1. Open a web browser and type in the IP address of the Palo Alto firewall.
2. Log into your firewall.

Create a NetFlow server profile

1. Select Device > Server Profiles > NetFlow and click Add.
2. Enter TrafficInsights as the name for the profile.
3. Set the default Template Refresh Rate to 5 minutes and 20 packets.
4. For the Active Timeout, set the value at 1 minute.
5. Select the checkbox for the PAN-OS Field Types.
6. For each NetFlow collector section, click Add.
   1. Name: TrafficInsights
   2. Server: <Auvik Collector IP>
   3. Port: <2055, 2056, 4432, 4739, 6343, 9995 or 9996>
7. Click Okay.

Assign the NetFlow server profile

The steps below specify a LAN interface for collecting NetFlow data. For a different interface, choose your desired interface in step 2.

1. Select Network > Interfaces > Ethernet.
2. Click a LAN interface to edit it.
3. In the NetFlow Profile drop-down, select the TrafficInsights server profile.
4. Click Okay.