Manufacturer:  Checkpoint

Model(s):  ALL

Version(s):   GAIA R81

URL:  https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/Netflow-Export.htm

Notes:

  • You can configure Security Gateways and Cluster Members as an Exporter of NetFlow records for all the traffic that passes through.
  • A maximum of three NetFlow Gaia sends the NetFlow records go to all configured NetFlowCollectors.
  • Netflow v5, v9 and IPFIX are all supported export formats.

Configuration steps

Configuring the NetFlow settings in Gaia Portal

  1. In the left navigation tree, click Network Management > NetFlow Export.
  2. In the Collectors section, click Add.
  3. Enter the required data for each collector

Parameter

Description

IP Address

The destination IPv4 address, to which Gaia sends the NetFlow packets.  Set this IP Address to your Scrutinizer IP address

This parameter is mandatory.

UDP Port Number

The destination UDP port number, on which the collector listens.

This parameter is mandatory.

NetFlow uses UDP ports 2055, 9555, 9995, 9025, and 9026. IPFIX uses UDP port 4739.

Export Format

The NetFlow protocol version to use:

o   Netflow_V5 – Protocol NetFlow v5

o   Netflow_V9 – Protocol NetFlow v9

o   IPFIX – Known as protocol “NetFlow v10”

The default is Netflow_V9.

Source IP address

The source IPv4 address of the NetFlow packets.

This must be an IPv4 address of the local host.

The default is an IPv4 address of the network interface, from which Gaia sends the NetFlow packets.

We recommend the default.

Enable

Select this option to enable the configured NetFlow Collector.
  1. Click OK.
  2. In the Advanced Options section, the NetFlow FW rule option controls for which traffic to enable the NetFlow export

Scenario

Instructions

You performed a Clean Install of R81

o   By default (this option is cleared) the NetFlow export is enabled for traffic accepted by all Access Control rules.

o   You can select this option to enable the NetFlow export only for traffic accepted by Access Control rules with the Track option Log and Accounting you configured in SmartConsole.

 

Important – If you selected this option, you must configure the applicable Access Control rules in SmartConsole.

You upgraded to R81from R80.40 or lower version

You must:

o   Configure select this option in Gaia Portal and click Apply.

o   Configure the applicable Access Control rules with the Track option Logand Accounting in SmartConsole.

Configuring the NetFlow settings in Gaia Clish

  1. Configure a new NetFlow collector:
add netflow collector ip <IPv4 Address of Collector> port <Destination Port on Collector> [srcaddr <Source IPv4 Address>] export-format {Netflow_V5 | Netflow_V9 | IPFIX} enable {yes | no}
  1. Configure for which traffic to enable the NetFlow export:
set netflow fwrule {1 | 0}

Scenario

Instructions

You performed a Clean Install of R81

o   By default (value 1) the NetFlow export is enabled for traffic accepted by all Access Control rules.

o   You can configure the value 0 to enable the NetFlow export only for traffic accepted by Access Control rules with the Track option Log and Accounting you configured in SmartConsole.

 

Important – If you configure the value 0, you must configure the applicable Access Control rules in SmartConsole.

You upgraded to R81 from R80.40 or lower version

You must:

o   Configure the value 0 in Gaia Clish.

o   Configure the applicable Access Control rules with the Track option Log and Accounting in SmartConsole.
 

 

Important – After you add, configure, or delete features, run the “save config” command to save the settings permanently.

 

In SmartConsole, configure the explicit Access Control rules

 

Important – This step is necessary only in these cases:

  • In Gaia Portal you selected the option “NetFlow FW rule”
  • In Gaia Clish you ran the command “set netflow fwrule 0”.
  1. From the left navigation panel, click Security Policies.
  1. Open the applicable policy.
  1. In the top left corner, click Access Control > Policy.
  1. Add an explicit rule for the traffic that you wish to export with NetFlow:
 

Important – In the Track column, you must select Log and Accounting.

Source

Destination

VPN

Services & Applications

Content

Action

Track

Source
Host or
Network
objects

Destination
Host or
Network
objects

*Any

Applicable
service
objects

* Any

Accept

Log

Accounting
  1. Publish the SmartConsole session.

Install the Access Control policy on the Security Gateway or Cluster object.