Hi,
Please download the new build 4.0.1783 that fixes the IPFIX support.
The steps are
1. Uninstall the old version
2. Download and install the new Trisul package
3. Edit the following file and remove the Palo Alto static templates
Open
/usr/local/etc/trisul/PI-7CA09636-02D4-45E7-AA00-BE0D49B94E26.xml
Remove the following lines that look like this
<StaticTemplates>
<Template id="256" name="Palo Alto IPv4 Standard">
<Fields>1,2,4,5,6,7,8,10,11,12,14,21,22,32,61,148,233</Fields>
</Template>
..
</StaticTemplates>
So the empty section must look like this
<StaticTemplates>
</StaticTemplates>
4. Make sure your port 9993 is set for Netflow via Customize > Access Points > UDP. Check the
trisul.org/docs/howto/netflow_setup.html for more
5. Send the IPFIX packets. Everything should show up as expected.
Further things to go :
1. Set the Home Network Subnets via Customize > HOme Networks
What caused the bug
We had done some special processing for Palo Alto Networks equipment IPFIX in situations where the template packets never came. This was leftover in the build you tried, causing even the Juniper IPFIX to trip up.
Let me know if everything is ok.
Regards,