Selecting Devices for NetFlow export

Hello all,

In our HQ we have multiple devices that are capable of NetFlow export; A Cisco ASA and a Riverbed Steelhead.

Our topology is pretty simple.

Internet and WAN circuits come in to separate interfaces on the ASA 5510, we have the Riverbed Steelhead 1050L in path between the LAN and the 5510 'inside' interface.

Then at each remote site we have Steelhead 250M's which I have configured for FlowExport.

My thought is the best bet will be to enable FlowExport at the ASA only since it should see all the traffic regardless of its destination where the Steelhead will only see traffic destined for the remote sites via the WAN.

But is there any value in exporting the NetFlow from both devices?

Thanks,
Ben

Find more posts tagged with

Accepted answers

All comments

MarieB

Howdy Ben--

Have you checked out the NTA FAQ thread? It has some helpful information in it including a link to a thread on Configuring Cisco ASA for NetFlow Transport.

JustBen

Hello!

I have actually configured the both devices without any issue, my question was more from a design perspective.

Since both devices are in the same location/subnet, is there any value in getting netflow data from both devices or is it just extra data at that point?

I believe the answer is "no there isn't any value" but I wanted to confirm that.

Thanks