PeteNetLive - KB0000055 - Enabling NetFlow on Cisco ASA v8.2(1)

0000055

Dated

13/10/09

Revision

0.01

Enabling NetFlow on Cisco ASA v8.2(1)

Problem

Cisco NetFlow lets you export information about traffic flow, it was originally written for the router IOS, but is now available for Cisco ASA, which uses NSEL (Note ASA uses NetFlow version 9 {newest at time of writing}).

Note: NetFlow can not give you "Live" data, but it can show you what has happened over a period of time, and remember like any other "Logging" this will have an adverse affect on the firewall (depending on how busy it is).

Setting this up is a two step process, the firewall is configured as the NetFlow "Exporter", then you install an application that accepts and collates that information, that is the NetFlow "Collector".

Solution

1. Log into your firewall via CLI and enter enable mode, then enter configure terminal mode.

User Access Verification

Password:
Type help or '?' for a list of available commands.
PetesASA> en
Password: ********
PetesASA# conf t
PetesASA(config)#

1. We haven't set one up yet, but we need to let the firewall know the IP address that the NetFlow "Collector" will be running on, in this case I'm going to use 10.254.254.253. (Note: the port number on the end is unimportant).

PetesASA(config)#
PetesASA(config)# flow-export destination inside 10.254.254.234 2055
PetesASA(config)#

2. The next command aggregates multiple events into separate NSELs on a 15 second interval.

PetesASA(config)#
PetesASA(config)# flow-export delay flow-create 15
PetesASA(config)#

3. Now we are going to set the refresh rate at which the templates are sent, if you do not do this it will default to 30 minutes.

PetesASA(config)#
PetesASA(config)#flow-export template timeout-rate 1
PetesASA(config)#

4. I'm going to apply this with the default global-policy, because most of you will have one, (Though I notice every 8.2(1) 5505 I've put in recently does NOT have one so check).

PetesASA(config)# policy-map global_policy
PetesASA(config-pmap)# class class-default
PetesASA(config-pmap-c)# flow-export event-type all destination 10.254.254.234
PetesASA(config-pmap-c)# exit

6. If you haven't got a global policy, this will not apply until you have applied the global_policy globally, this is done with a service-policy command, check to see if you already have this command in your config, or simply execute the command and the firewall and will tell you, like so....

Note: If it does not error then it was NOT applied :)

PetesASA(config)#
PetesASA(config)# service-policy global_policy global
WARNING: Policy map global_policy is already configured as a service policy
PetesASA(config)#

7. Don't forget the save the config with a "write mem" command.

8. Now go to the machine you want to install your NetFlow collector software on, I prefer Plixer Scrutinizer because its free and its easy to set up. Connect to it via the built in web site (username admin password admin) > Click Status > Expand Ungrouped > Expand the firewall > Flow templates > Pick one.

9. There's your throughput :)

If this post helped you, PLEASE take the time to +1 it.

Please be aware, all information is provided free, but it does cost me to have this site hosted, if I've helped you in any way, or saved you some time/cost please take time to make a donation.

If you have anything to add to an article, or have an article you would like us to publish please feel free to contact PeteNetLive. (Please be aware I get a LOT of email, I cannot assist and fix everyone's problems, please do not be offended if you do not get a response).

References - Credits - Or External Links