ASA support for netflow in 8.2(1)

Hi Donald--

Thanks for the info. Have you seen the NTA FAQ? It has ASA posts in it that may help the situation.

This has been marked to the PM, too.

Thx,

M

There is great information about this here:

http://support.solarwinds.com/kbase/ProblemDetail.cfm?ID=1264

The bug is known on versions before 8.2(11).  The bug has to do with the ASA not sending the ifIndex in the netflow packet to Orion NTA.  This would still show data, but it would show from the wrong interface (ie Null0, etc).  Once you are on 8.2(12) or newer, this bug is fixed.

Hope this helps.

Sohail , I know about the interface issue I was the person whom actually filed the bug with Cisco and worked with SW on it.  But in 8.2(1) there was no such issue.  What I found was that the system said it was sending netflows but it actually was not.  When I jumped to 8.2(2) with no other changes I had netflows going out just fine.

You also have your versions wrong.  I do not mean to be a smarty pants I just wanted to be clear on everything and not have everyone confused.

8.2(1)-12 is what you are talking about not 8.2(12).  The latest code is only 8.2(2)

Right!  8.2.1(12) is known to be good.  I recently worked with a customer with a preview release 8.3 so that should be coming soon as well.

Hi I have all day been trying to configure my ASA 5510 to send netflows to a Server for traffic monitoring, but still no success. I know there are lots of posts, about this issue and  I have read all. My ASA is running image 8.4 and NTA is version 3.6.

I used wireshark to make sure that the ASA is indeed sending the cflow packets and it is sending them. But NTA sees nothing.

The Network Collector Services shows as up on port 2055.

I will appreciate any help.

Thank You in Advance.

Joseph

I apologize, I have just noticed it!! I'm running ASA image 8.2.1. I'll upgrade my ASA.

thanks anyway

I think that 8.2(2).9 may have a problem with NTA 3.6, I've confirmed that the server Orion is running on is recieving netflow from the ASA and confirmed that our global network/sec op teams are recieving netflow on their QRadar box from the ASA but Orion isn't showing the data and believes the last time it received netflow from that box was the day I updated the ASA software to 8.2(2).9.

Is this a known issue?

Hi NBS--

I'll let the PM and they let you know for sure.

M

I think that 8.2(2).9 may have a problem with NTA 3.6, I've confirmed that the server Orion is running on is recieving netflow from the ASA and confirmed that our global network/sec op teams are recieving netflow on their QRadar box from the ASA but Orion isn't showing the data and believes the last time it received netflow from that box was the day I updated the ASA software to 8.2(2).9. Is this a known issue?

I haven't heard this come up in our bug reviews.   Please go ahead and submit a support ticket and we'll investigate.