> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-netflow-collector.md).
# Activate NetFlow Collector
To receive NetFlow flow records from an external source, you must first set up the NetFlow Collector applet on a Broker VM within your network. NetFlow versions 5, 9, and IPFIX are supported.
To increase the log ingestion rate, you can add additional CPUs to the Broker VM. The NetFlow Collector listens for flow records on specific ports either from any, or from specific IP addresses.
After the NetFlow Collector is activated, the NetFlow Exporter sends flow records to the NetFlow Collector, which receives, stores, and pre-processes that data for later analysis.
### Performance Requirements
The following setups are required to meet your performance needs:
* 4 CPUs for up to 50K flows per second (FPS).
* 8 CPUs for up to 100K FPS.
{% hint style="info" %}
**Note**
Since multiple network devices can send data to a single NetFlow Collector, we recommend that you configure a maximum of 50 NetFlow Collectors per Broker VM applet, with a maximum aggregated rate of approximately 50K flows per second (FPS) to maintain system performance.
{% endhint %}
### Prerequisite
[Set up and configure Broker VM](file:///data-management/broker-vm/set-up-and-configure-broker-vm.html)
### How to activate the NetFlow Collector
1. Select Settings → Configurations → Data Broker → Broker VMs.
2. Do one of the following:
* On the Brokers tab, find the Broker VM, and in the APPS column, left-click Add → NetFlow Collector.
* On the Clusters tab, find the Broker VM, and in the APPS column, left-click Add → NetFlow Collector.
3. Click +Add New.
4. Configure your NetFlow Collector.
**General Settings**
Specify the number of the UDP Port on which the NetFlow Collector listens for flow records (default 2055).
This port number must match the UDP port number in the NetFlow exporter device. The rules for each port are evaluated, line by line, on a first match basis. Cortex Cloud discards logs for non-configured flow records without an “Any” rule.
Since Cortex Cloud reserves some port numbers, it is best to select a port number that is not in the range of 0-1024 (except for 514), in the range of 63000-65000 or has one of the following values: 4369, 5671, 5672, 5986, 6379, 8000, 8888, 9100, 15672, or 28672.
**Custom Settings**
| Field | Description |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Source Network | Specify the IP address or a Classless Inter-Domain Routing (CIDR) of the source network device that sends the flow records to Cortex Cloud. Leave the field empty to receive data from any device on the specified port (default). If you do not specify an IP address or a CIDR, Cortex Cloud can receive data from any source IP address or CIDR that transmits via the specified port. If IP addresses overlap in multiple rows in the Source Network field, such as 10.0.0.10 in the first row and 10.0.0.0/24 in the second row, the NetFlow Collector captures the IP address in the first row. |
| Vendor and Product | Specify a particular vendor and product to be associated with each dataset entry or leave the default IP Flow setting.
The Vendor and Product values are used to define the name of your Cortex Query Language (XQL) dataset \\_\\_raw. If you do not define a vendor or product, Cortex Cloud uses the default values with the resulting dataset name ip\_flow\_ip\_flow\_raw. Consider changing the default values in order to uniquely identify the source network device.
After each configuration, select 
to save your changes and then select Done to update the NetFlow Collector with your settings.
|
5. (Optional) Make additional changes to the NetFlow Collector data sources.
* You can make additional changes to the Port by right-clicking the applicable UDP port and selecting the following:
* Edit: To change the UDP Port, Source Network, Vendor, or Product defined.
* Remove: To delete a Port.
* You can make additional changes to the Source Network by right-clicking on the Source Network value.
The options available change, according to the set Source Network value.
| Option | Description |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Edit | To change the UDP Port, Source Network, Vendor, or Product defined. |
| Remove | To delete a Port. |
| Copy entire row | To copy the Source Network, Product, and Vendor information. |
| Open IP View | To view network operations and to view any open cases on this IP within a defined period. This option is only available when the Source Network value is a specific IP address or CIDR. |
| Open in Quick Launcher | To search for information using the Quick Launcher shortcut . This option is only available when the Source Network value is a specific IP address or CIDR. |
* To prioritize the order of the NetFlow formats listed for the configured data source, drag and drop the rows to change their order.
6. Activate the NetFlow collector applet.
After successful activation, the APPS field displays NetFlow with a green dot indicating a successful connection.
7. (Optional) To view NetFlow Collector metrics, left-click the NetFlow connection in the APPS field for your Broker VM.
Cortex Cloud displays the following information:
| Option | Description |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connectivity Status | Whether the applet is connected to Cortex Cloud. |
| Logs Received and Logs Sent | Number of logs that the applet received and sent per second over the last 24 hours. If there are more logs received than sent, this can indicate a connectivity issue. |
| Resources | Displays the amount of CPU, Memory, and Disk space the applet uses. |
8. Manage the NetFlow Collector.
After you activate the NetFlow Collector, you can make additional changes. To modify a configuration, left-click the NetFlow connection in the APPS column to display the NetFlow Collector settings, and select:
* Configure to redefine the NetFlow Collector configurations.
* Deactivate to disable the NetFlow Collector.
You can also [Ingest NetFlow flow records as datasets](https://docs-cortex.paloaltonetworks.com/access?ft:baseId=UUID-9d4ae74b-4d75-3e69-ffe6-783a091477dc).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-netflow-collector.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.