topic Re: Cisco FirePower Reporting - Bandwidth Statistics in Network Security

Cisco FirePower Reporting - Bandwidth Statistics

John5mith — Tue, 12 Mar 2019 13:24:03 GMT

Hi All,

I was hoping someone could shed some light on how I can create a bandwidth report to show utilization stats for traffic entering the inside interface and existing the outside interface on my Cisco Firepower ASA.

I currently have a 'Connection Summary Data' report showing Traffic (KB/s) against Time (see 'Report Parameters' attached) but this looks like an aggregated report for all interfaces as the KB/s shown in the report (see 'Report Output' attached) look like it is way above our Internet line speed. So I was wondering whether there was any way which a report could be created to show only traffic existing the outside interface?

Thanks,
John

I don't think you can do that

Marvin Rhoads — Thu, 18 May 2017 08:08:28 GMT

I don't think you can do that with FMC.

I'd suggest doing Netflow on the ASA itself and using a Netflow collector like PRTG, ManageEngine etc. to create your reports.

Thanks Marvin. You would

John5mith — Mon, 22 May 2017 16:07:22 GMT

Thanks Marvin. You would think that this should be possible as it seems the device is logging this data. Do you know whether anything is possible with the use of estreamer combined with a 3rd party application or is this purely for security event reporting?

You're welcome.

Marvin Rhoads — Tue, 23 May 2017 03:07:53 GMT

You're welcome.

You're right - one would think this would be a simple query that they would have pre-built reports for the administrator to use. I gave similar feedback to Cisco just last week.

AFAIK, eStreamer cannot be used for this purpose. Per the eStreamer Integration Guide:

The service can stream the following categories of data:

Intrusion event data and event extra data
Correlation (compliance) event data
Discovery event data
User event data
Metadata for events
Host information
Malware event data

Source:

http://www.cisco.com/c/en/us/td/docs/security/firepower/621/api/eStreamer/EventStreamerIntegrationGuide_621/Intro.html

Thanks again much appreciated

John5mith — Wed, 24 May 2017 11:18:07 GMT

Thanks again much appreciated!

Re: Cisco FirePower Reporting - Bandwidth Statistics

guibarati — Wed, 17 Jan 2018 21:23:32 GMT

I stubbed upon this question looking for something else, but here is how I do it:

Go to Analysis -> Connection Events, Click Edit Search, configure the search constrain to specific Zone/Interfaces (ingress or egress).

The, select the time period you want to sample, Click on "Switch Workflow", select the option "Traffic over time"

This should give you the graph you are looking for.

Re: Cisco FirePower Reporting - Bandwidth Statistics

Austin Clark — Wed, 19 Jun 2019 17:15:31 GMT

This only works if you are logging all traffic as connection events.

Re: Cisco FirePower Reporting - Bandwidth Statistics

guibarati — Wed, 19 Jun 2019 18:05:21 GMT

This is correct. with the workflow the FMC will show you the information based on the "connection events" table. It will show you an aggregate graph of the "initiator bytes" or "responder bytes" depending on the graph you select.

Another thing I found out since my post is that you can't filter traffic based on source or destination zones for the graphs. You can use source/destination zones on the connection events table, but not on the graphs.

When you open the "search" page for the connection events it will show you an asterisk "*" on the fields that can be used as search constrains on the graphs and src/dst zones are not one of them. So you would have to use something like the subnet IPs that are related to each zone to get the bandwidth for specific zone pairs.

Re: Cisco FirePower Reporting - Bandwidth Statistics

cyborgzhouse — Tue, 03 May 2022 19:19:07 GMT

I have traffic graphing on the Firepower Threat devices. You have to use the LINA OS partition using the FTD management interface.

This works on everything except the Azure or AWS virtual FTD's. I use CACTI for traffic graphing.

Chris