Netflow and VSX

[bingdude]

Hi All,

I have netflow configured on VS0 of our VS appliances. I am receiving netflow, but I do not see netflow from the VS instances. Am I missing something on the configuration for VS instances to report netflow? The netflow is setup using the default interface which appears to be using the management interface of the appliances.

Thanks,

Bill

[kaland]

Hi,
This is unfortunately by design. We have the same challenge with this. Hosting several VSX cluster with multiple customer running their separate VS. The customers need to collect netflow from only their vs to be able to forward this to SIEM system and monitoring system.
Hopefully Check Point will do something with this design. I have explained this design problem for the several times, and they understand this is a issue for an MSP.

We´re working on a solution on our own by using https://github.com/phaag/nfdump -


From sk102041

NetFlow on VSX
Configure the NetFlow collector on the network of VSX Gateway itself - context of VS0. It should be routable only from VS0.

NetFlow v5 supports only 4 cluster members and only 64 Virtual Systems, due to the limitation of engine ID size (1 Byte).

You can use Wireshark to identify NetFlow packets (CFLOW). Use VSID:

Clusters in NetFlow v5: See engine ID - 2 upper bits are Cluster ID, and 6 lower bits are VSID.

Clusters in NetFlow v9: See source ID - 3rd byte is Cluster ID, and lower 2 bytes are VSID.

[kaland]

I´ve ha started a discussion thread at CheckMates

https://community.checkpoint.com/thr...low-data-pr-vs