Palo Alto

To configure NetFlow on a Palo Alto firewall, follow these steps:

1. Define a NetFlow Profile

1. Go to Device → Server Profiles → NetFlow.

2. Click Add.

3. Give the profile a name.

4. Configure:

   • Collector IP address (your flow collector).

   • Port (default 2055 for NetFlow, or whatever your collector expects).

   • Protocol: UDP.

   • Active Timeout: Typically 1 minute (controls how often long-lived sessions are reported).

   • Inactive Timeout: Usually 15 seconds (when a session has been idle).

   • Select Template Refresh Rate (number of flows before resending template).

2. Attach NetFlow Profile to Interfaces

1. Go to Network → Interfaces.

2. Select the interface(s) you want to export flows for (e.g., WAN, LAN, DMZ).

3. Under the Advanced → NetFlow tab:

   • Enable NetFlow.

   • Choose the NetFlow profile you just created.

3. Commit the Configuration

• Click Commit to push changes to the running config.

4. Verify

• On the collector, you should start seeing flows.

• On the firewall itself, you can check via CLI:

  > show netflow state
  > show session info

  These confirm templates and exports are active.