Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Netflow on ASA

I have cisco ASA 5520 that i recently uprgraded to 8.2. Im tryiing to setup netflow but NTA 3.5 is giving me this error.

NetFlow Receiver Service encountered an invalid V9 template with ID 266 from device X.X.X.X

NetFlow Receiver Service encountered an invalid V9 template with ID 267 from device X.X.X.X

NetFlow Receiver Service encountered an invalid V9 template with ID 268 from device X.X.X.X

Just wanted to know what im doing wrong or if its even supported on NTA

Find more posts tagged with

Accepted answers

chris.lapoint

We've released NTA 3.5 SP2 which adds Cisco ASA support. Please see this post for more details:

All comments

Donald_Francis

As far as I have heard that implementation of netflow is not the usual and Solarwinds currently does not support it.

rlloveras

Is there any plans on future support for this item?

FormerMember

The NetFlow on the ASA is using Cisco's flexible netflow feature to send security info with the netFlow protocol. It is not the same data as a standard NetFlow packet, which is why NTA doesn't recognize it. What business problem would that data solve for you?

Donald_Francis

I would like to see it added, I think it could be more effcient and effective then syslog.

dwiens

I haven't researched this, but do the ASAs send the regular NetFlow data as well asn the security info via NetFlow or is it just the Security Info?

simon.fotakis

Hi,

We also have a requirement to gain visibility into traffic flows from our ASA 5550 firewalls for the purposes of analysing web site traffic etc.

This feature is extremely valuable as we currently monitor all our WAN routers via the SolarWinds Netflow module and are capable of instantly obtaining a snap shot of all internal network traffic flows, but not external, as our ASAs cannot be monitored via Netfow.

I have already raised this with your support team who have assured us this is top priority for your dev team (or so they said)

FormerMember

We also have a requirement to gain visibility into traffic flows from our ASA 5550 firewalls for the purposes of analysing web site traffic etc.

I understand but the ASA's data flow does not include traffic. It does not include the standard NetFlow data.

rudedawg

I just spoke with Plixer and they were quite pleased that version 7 of the Scrutinizer (their latest version of NetFlow analyzer) will work with ASA 5510, but like it has been recorded in this forum, the traffic conversations will be represented in the data ONLY after they have finished; causing latency in their presentation (not realtime).

mlanasa

I don't see version 7 yet on the website, do you know when it will be released

rudedawg

An SE is going to walk me through it next week on a conference call. If I do purchase it I will just add it to the SolarWinds interface through Admin -> Customize -> External Websites.

***UPDATE***

Version 7 is now up on their site:

Trial is timebombed

Free is not as function and only saves 24 hours of logs

Donald_Francis

Actually it looks like it does indeed include traffic data. I did some captures and looked at the payload of the packets and saw traditional netflow.

I would not jump ship yet I would think we should see it in NTA before too long, thats a total quess however.

ddemetra

This is good news that Netflow from the ASA's will soon be supported.

We have a Router 7204 that could send us Netflow, but it is outside out firewalls.

This not only makes collecting the data harder, but the collected data will only show the PAT'ed addresses, so it would not be nearly as usefull.

As a current support contributor, I would also like to see this moved up in the priority list for the next release.

Thanks, Dimitri

chris.lapoint

Dimitri, thanks for the feedback. We're working on this right now, so stay tuned.

ddemetra

Chris, does it look like the Netflow IP's will be pre PAT'ing when captured from the ASA's?

Thanks, Dimitri

GZhytar

Dimitri,

you are right, by default we consume pre-PAT ip-address. ASA flows also carry mapped PAT ip address.

More details here: http://www.cisco.com/en/US/docs/security/asa/asa82/netflow/netflow.html#wp1028790

thanks,

chris.lapoint

We've released NTA 3.5 SP2 which adds Cisco ASA support. Please see this post for more details:

swilliams

I have installed SP2 for NTA 3.5, and also have 8.2 on the ASA firewall that I am trying to get NetFlow from, but still no luck. What is the correct settup on the ASA to get the NetFlow data into Orion? I am sure that it is just something simple that I am missing.

swilliams

Nevermind, I just found the post with the instructions on the ASA configuration.