topic internet ckt is saturated- FMC doesn't show the top use correctly. in Network Security

internet ckt is saturated- FMC doesn't show the top use correctly.

loc.nguyen — Mon, 09 May 2022 15:05:52 GMT

Hi,

We have an issue that the internet is statured on a FTD.

It doesn't seem FMC tools can help figure out what causes it. Or I did not find the right place to look into it yet.

Could you advise?

Thanks

Loc

Re: internet ckt is saturated- FMC doesn't show the top use correctly.

Marvin Rhoads — Mon, 09 May 2022 17:07:04 GMT

Exporting Netflow data from your FTD is the best way to visualize and analyze the usage of your system on a per-user (or per-address actually in most cases) basis. I have used the free PRTG version for such cases before.

Re: internet ckt is saturated- FMC doesn't show the top use correctly.

loc.nguyen — Mon, 09 May 2022 19:30:43 GMT

Thanks, Can we export Netflow data via outside interface?

Is is possible if you send a link for that?

Thanks

Loc

Re: internet ckt is saturated- FMC doesn't show the top use correctly.

Marvin Rhoads — Tue, 10 May 2022 11:55:00 GMT

Netflow data is exported from the diagnostic interface. However that traffic can be routed in your network back though the inside to the outside.

Re: internet ckt is saturated- FMC doesn't show the top use correctly.

loc.nguyen — Wed, 11 May 2022 16:54:35 GMT

Hi,

I tried to set up netflow on an ASA in another city, outside interface. And export it to my home lab (99.x.x.22). I use PRTG in my lab. It did not work yet. Do you think it is ASA config need to check ?

flow-export destination outside 99.x.x.22 5555
flow-export template timeout-rate 15
flow-export delay flow-create 60

class-map flow_export_class
match any

policy-map global_policy
class flow_export_class
flow-export event-type all destination 99.x.x.22

service-policy global_policy global

Thanks

Loc

Re: internet ckt is saturated- FMC doesn't show the top use correctly.

Marvin Rhoads — Thu, 12 May 2022 15:26:09 GMT

Check using the command "show flow-export counters". If that indicates flow records are being sent (run it more than once to see the number increment) then check a packet capture at the ASA (and possibly the PRTG server) to make sure the records are leaving the ASA outside interface and arriving at the server.