This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

ASA Configuration

FormerMember over 14 years ago

I just upgraded my NTA module on Orion to Service Pack 2 which supports receiving netflow data from the ASA platform. I have also followed the steps in the followig document to configure my ASA. My ASA has also been upgraded to 8.2(1) as well.

When I view my NTA module in Orion the ASA is showing "never" for the last netflow received column. Am I missing something??? Below is my ASA config for the Netflow export to my Orion Server.

access-list netflow-export extended permit ip any any

flow-export destination inside 10.1.200.10 2055
flow-export template timeout-rate 1
flow-export delay flow-create 60

class-map netflow-export-class
match access-list netflow-export
policy-map netflow-export-policy
class netflow-export-class
flow-export event-type all destination 10.1.200.10

0 chris.lapoint over 14 years ago

Have you managed all Cisco ASA interfaces in Orion and added them all as monitored sources in NTA? There is a bug in the Cisco ASA software that causes NetFlow to be exported on unexpected interfaces indexes. So, NTA may be receiving NetFlow, but it appears on an interface that you're not managing.
If that doesn't work, you should install Wireshark on your Orion server, filter on your ASA source address, and ensure that receiving NetFlow packets.
Cancel
Vote Up 0 Vote Down

Cancel
0 bwilkins over 14 years ago in reply to chris.lapoint

We recently downgraded our ASA 5520's from the 8.2(1) code due to other bugs in that code dealing with VPN's and other NAT policies. So I wish Cisco would come out with a solid 8.2 release so we could do netflow from our ASA platforms. If anyone knows of a good stable 8.2 release let me know.
Cancel
Vote Up 0 Vote Down

Cancel
0 ecklerwr1 over 14 years ago in reply to bwilkins

@bwilkins
Cisco is kinda tight on compatibility matrix with different vpn devices and software that works correctly with the ASA 5500 series. Not sure if you've seen it but this might help:
http://www.cisco.com/en/US/docs/security/asa/compatibility/asa-vpn-compatibility.html
Cancel
Vote Up 0 Vote Down

Cancel
0 skaczkowski over 14 years ago in reply to ecklerwr1

We were told that the ASA's didn't have full Netflow capabilities so maybe that's the issue you're running in to..

-SK
Cancel
Vote Up 0 Vote Down

Cancel
0 ecklerwr1 over 14 years ago in reply to skaczkowski

Have you seen this kb article:
http://support.solarwinds.com/kbase/ProblemDetail.cfm?ID=1264
Cancel
Vote Up 0 Vote Down

Cancel
0 ecklerwr1 over 14 years ago

@darkshooter
netflow export has been verified with 8.2.(1)12
also have you tried adding flow-export enable command?
Cancel
Vote Up 0 Vote Down

Cancel