Netmon Docs · Device Configuration Guide

Palo Alto PAN-OSv7.0.20

Send NetFlow telemetry from Palo Alto PAN-OS firewalls to Netmon, and mirror at the upstream switch — PAN-OS itself cannot source a SPAN.

This page covers Palo Alto Networks next-generation firewalls running PAN-OS 11.1 (PA-Series and VM-Series). It explains how to send flow telemetry to Netmon and why traffic mirroring must be done upstream of the firewall.

Mirror traffic (SPAN)

PAN-OS has no SPAN-OUT capability: a Palo Alto Networks firewall cannot mirror or copy transit traffic out of one of its data interfaces to feed an external collector. To deliver mirrored traffic to a Netmon sniffer NIC, configure the SPAN/mirror session on the upstream switch that the firewall connects to, and cable that switch’s mirror destination port to the Netmon capture NIC. Use that switch’s page in this guide for the exact SPAN configuration.

Two PAN-OS features use the word “tap”/“mirror” but neither sources a SPAN for Netmon:

Tap mode interface is the firewall receiving a SPAN, not sourcing one. You dedicate a firewall interface as a tap-mode port and connect it to a switch SPAN port so the switch feeds the firewall mirrored traffic for visibility. Per the PAN-OS documentation: “By dedicating an interface on the firewall as a tap mode interface and connecting it with a switch SPAN port, the switch SPAN port provides the firewall with the mirrored traffic.” This is the firewall acting as a monitor, the opposite direction of what Netmon needs, so it is not applicable for feeding Netmon.
Decrypt Mirror can mirror decrypted SSL/TLS traffic out a dedicated interface, but it is license-gated (requires a Decryption Port Mirror license) and only ever carries already-decrypted sessions, not the full transit stream. It is not a general-purpose SPAN source and is out of scope for this guide.

Note

Bottom line for PAN-OS: there is nothing to configure on the firewall for mirroring. Mirror at the upstream switch into the Netmon NIC. On the Netmon side, set the receiving NIC to Sniffer (manual) — see Receiving the Data in Netmon.

Source: PAN-OS Networking Administrator’s Guide, PAN-OS 11.1: Tap Interfaces. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/configure-interfaces/tap-interfaces

Export flow data

PAN-OS firewalls export flow telemetry as NetFlow Version 9 only — there is no IPFIX, no NetFlow v5, and no sFlow. Per the PAN-OS Web Interface Help: “All Palo Alto Networks firewalls support NetFlow Version 9. The firewalls support only unidirectional NetFlow, not bidirectional.” Netmon’s flow collector accepts NetFlow v9 on UDP 9996. The PAN-OS NetFlow collector port defaults to 2055, so you must override it to 9996 to point the export at Netmon.

Configure NetFlow from the web interface:

Create a NetFlow server profile under Device > Server Profiles > NetFlow and click Add. Give the profile a Name (up to 31 characters; letters, numbers, spaces, hyphens, underscores). Leave the defaults for Template Refresh Rate (Minutes 30, Packets 20) and Active Timeout (5 minutes) unless you have a reason to change them.
```
Device > Server Profiles > NetFlow > Add
```
In the profile, under Collectors, click Add and enter the Netmon collector. Set Server to <netmon-ip> and set Port to 9996 (overriding the 2055 default). Up to two collectors are allowed per profile.
```
Name:   netmon
Server: <netmon-ip>
Port:   9996
```
Assign the profile to each ingress interface you want to export flows for. Go to Network > Interfaces > Ethernet, edit the interface, select the NetFlow profile you created, and click OK.
```
Network > Interfaces > Ethernet > <ethernet1/X>
NetFlow Profile: netmon
```
(PA-7000 Series, PA-7500, PA-5500 Series, PA-5450, and PA-5200 Series only) Set a service route so NetFlow leaves the firewall from the address Netmon knows the device by. Go to Device > Setup > Services > Service Route Configuration, select NetFlow in the Service column, and specify the source interface and source IP address that Netmon expects.
```
Device > Setup > Services > Service Route Configuration
Service: NetFlow  ->  Source Interface / Source Address
```
Commit the configuration to activate the export.
```
Commit
```

Important

PAN-OS NetFlow is unidirectional, so each direction of a conversation is reported as a separate record, and there is no sampled NetFlow — every flow is exported. Make sure the firewall reaches Netmon on UDP 9996 and that the source address (step 4, where applicable) matches the address Netmon has for this device. Enable Allow Netflow Data Collection for the device in Netmon — see Receiving the Data in Netmon.

Source: PAN-OS Web Interface Help, PAN-OS 11.1: Device > Server Profiles > NetFlow. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/device/device-server-profiles-netflow

Source: PAN-OS Administrator’s Guide, PAN-OS 11.1: Configure NetFlow Exports. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/netflow-monitoring/configure-netflow-exports

PreviousHuawei VRP NextUbiquiti UniFi / EdgeRouter / EdgeSwitch