I'm trying to setup netflow export on my Check Point firewall to my Stealthwatch flow collector, but it seems that the data isn't being accepted because the exported records are missing the mandatory "ipv4 tos" key value. I used https://configurenetflow.info/?Platform=CheckPoint+Firewall for basic guidance, and flows are being exported, just not with all the mandatory key values for Stealthwatch. Anyone have this working who can share how to make the necessary changes on the exporter side?
It's not an official page. Please check below Checkpoint official page and it tells you the right configuration.
It means CP doesn’t support native NetFlow. FlowCollector side just accept normal NetFlow. So, probably CP support team can answer right configuration to cover native NetFlow generating command or settings.
Below link tells you about normal format of NetFlow.
Oh, I miss understand your questions, sorry.
The NetFlow generating from Checkpoint has missing data like as Type of Service and input interface, right?
I checked Checkpoint manual but there is no special option for these, just turn on/off only. (only option is NetFlow V5/V9/IPFIX)
I'll check Cisco's internal resources and past case, and post information if I find something for this.
And any chance to change export format to IPFIX? On R80 OS, it added IPFIX and it may be different results.
Updates for this issue.
I found old TAC case and it tells only below field are send from CheckPoint NetFlow V9:
Source IP address
Destination IP address
Ingress physical interface index (defined by SNMP)
Egress physical interface index (defined by SNMP)
Packet count for this flow
Byte count for this flow
Start of flow timestamp (FIRST_SWITCHED)
End of flow timestamp (LAST_SWITCHED)
IP protocol number
TCP flags from the flow (TCP only)
So if you can't see these values in SWE, it means there is SWE side bug and in this case please open Cisco TAC case with PCAP file. TAC team will analyze/fix it. If you need another data and it doesn't include the above list, please contact Checkpoint to enhance NetFlow Field.
I hope this is help.