Cisco ASA netflow not exporting flows from Insie Interface.

See this KB

Hi Andy -

I've done the step by step in that KB, and I'm still not seeing flow info from that interface.

Thanks,

Andras

Hi Andreas,

What software version do you have on the ASA?

I'm running 8.2.1.

Andras

This is noted on the KB

• There is a bug in ASA versions prior to 8.2.1.12 that causes flow information to be reported from incorrect interfaces.

I think this is what you are seeing.

Hi Andy -

I saw that bug and the workaround, so I added all the interfaces on the ASA to NTA eligible receivers.

I don't think I was clear on the original posting. In NTA I see that I'm receiving traffic from the Inside interface, but what I'm not seeing is any traffic to and from endpoints that sit behind the Inside interface.

An example:
I see traffic flows between servers in my DMZ an the Internet (though only one direction - another problem).

I see traffic between my VPN users in my Extranet going to servers off the DMZ or other non-Inside interfaces, or to the Internet.

But I don't see any endpoints on the insie of my Inside interface (like client machines on the various floors in our builidng).

Another example-

When I look at the top conversations over the last hour, I see the largest at 400MB or so between an FTP server and the outside, but I don't see anything indicating the two different 600+MB iso downloads I did from my workstation.

Thanks,

Andras

I see. There is also an issue where the ASA does not properly mark the direction of the flows, but I don't know if this could be causing that behaviour. You may need to work with TAC on this one. Can you take a packet cap on the NTA server and see what the cflow export  packets have in them. You can send them to me too, I'll take a look.

I'm having an issue with netflow only reporting my outside interface and not either of my two inside interfaces. How can I correct this? It reports both on SNMP...

fixed it, had to type ip flow egress on all the interfaces

Hi,

This command is seen as invalid on the ASA 5520 device version 8.2.

Please advise.

Thank you.