Netflow data not matching ACC
Hi - I've set up my palo to monitor an important tunnel for Netflow. The netflow gets sent to Orion.
Netflow is indeed sending to Orion and it looks good, data is analyzed, graphed, etc, however total throughput doesn't seem to line up.
If I got to ACC and filter on just the tunnel, and show for 24 hours, it wildly is off compared to the netflow data. We're talking 1GBs to 15GBs.
I decided to changed the timers on netflow to 1 20 1 to ensure no missed packets and all the data is sent.
It's still wildly off.
I can't seem to figure out why. I'm wondering if since the data comes from this tunnel, then leaves another interface on the firewall that perhaps ACC is accounting for the data going through that tunnel to somewhere else?
Do I need to enable Netflow on all the other interfaces this traffic traverses?
Posted Apr 9, 2025, 8:20 PM UTC