topic Re: FMC Netflow Question in Network Security

FMC Netflow Question

benolyndav — Sat, 22 Jun 2024 11:34:15 GMT

Recently upgraded to 7.0.6.2-65 and Netflow has stopped working any ideas why and if so Is there some instructions you can share for me to put this right again.??

Thankyou

Re: FMC Netflow Question

Rob Ingram — Sat, 22 Jun 2024 12:03:51 GMT

@benolyndav on older versions you can only configure netflow using flexconfig, can you confirm the flexconfig settings are still deployed to the FTD?

https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/netflow/216126-configure-netflow-secure-event-logging-o.html

Re: FMC Netflow Question

benolyndav — Mon, 24 Jun 2024 08:48:10 GMT

@Rob Ingram

They are there on the list but dont seem to be in te policy anymore

Re: FMC Netflow Question

Rob Ingram — Mon, 24 Jun 2024 08:51:42 GMT

@benolyndav the quickest and easiest solution might just be to reconfigure, assign the policy to the FTD and redeploy. Using the link above to reconfigure.

Re: FMC Netflow Question

MHM Cisco World — Mon, 24 Jun 2024 08:57:31 GMT

when you click it do you see the config or it disappear ?
MHM

Re: FMC Netflow Question

benolyndav — Mon, 24 Jun 2024 12:36:34 GMT

Yes its there still

Re: FMC Netflow Question

benolyndav — Mon, 24 Jun 2024 12:37:43 GMT

@Rob Ingram
I thought I had to delete this policy first?? are you saying I can just create a new one from scrtach and deploy,?

Thanks

Re: FMC Netflow Question

Rob Ingram — Mon, 24 Jun 2024 12:40:54 GMT

@benolyndav it looks like the policy is empty and nothing configured? Either re-apply the configuration settings to the existing objects and deploy or create new flexconfig objects and deploy.

Re: FMC Netflow Question

benolyndav — Sat, 06 Jul 2024 09:00:57 GMT

@Rob Ingram
We have another x2 FTDs also that are managed by a different FMC and they still have the objects present, is it going to be easier to delete all the Flexconfig objects for Netflow and start again, I see there is built in objects to remove Fleconfig objects ??

Re: FMC Netflow Question

Rob Ingram — Sat, 06 Jul 2024 09:07:25 GMT

@benolyndav yes it seems like the quickest and easiest thing to do.

Re: FMC Netflow Question

benolyndav — Tue, 23 Jul 2024 18:15:02 GMT

@Rob Ingram
So on our other FMC the Flexconfig policy as the destination and parameters objects in the policy but they are the wrong objects, this is since the upgrade to 7.0.6.2, can I just delete theses objects from the policy and add the correct objects from the list then save and deploy,? is ther anything to be aware of.?

Thanks

Re: FMC Netflow Question

Rob Ingram — Tue, 23 Jul 2024 18:23:35 GMT

@benolyndav remove the old flexconfig objects and add a flexconfig object to delete the old netflow configuration as per below.

Deploy to clear down the old configuration, then deploy the new settings.

Re: FMC Netflow Question

MHM Cisco World — Tue, 23 Jul 2024 18:34:14 GMT

As a rule any flexconfig stop work after upgrading start search about if this op add to fmc ot not

I think this op add to fmc so no need more flexconfig and that why it stop

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center-virtual/221612-htz-01-2024-configure-netflow-in-fmc.html

MHM

Re: FMC Netflow Question

benolyndav — Tue, 23 Jul 2024 19:48:57 GMT

@Rob Ingram

When I select the objects Delete_Destination and Clear_Parameters they go into the top section and not the bottom section like yours in the image.??

Re: FMC Netflow Question

Rob Ingram — Tue, 23 Jul 2024 19:53:35 GMT

@benolyndav as per the screenshot I provided, which is from the official Cisco guide here.

FYI, netflow is built-in to the FMC GUI from 7.4.

Re: FMC Netflow Question

benolyndav — Wed, 24 Jul 2024 13:59:23 GMT

Hi
So I had a look this morning it looks like if I go to create a new Flexconfig policy then I can add the Netflow (Delete_destination, and Clear_parameters) and they do go into the bottom section as per your image, So if I create the new flexconfig policy and add the objects then assign the FTDs to the policy is this another way I clear the flexconfig confguration? then i could re add destination and parameters and deploy again.??

Re: FMC Netflow Question

Rob Ingram — Wed, 24 Jul 2024 14:03:03 GMT

@benolyndav if you do the above, this removes the old entries from the FTD. You then update the policy to apply new settings and deploy to the FTD.

Re: FMC Netflow Question

benolyndav — Wed, 24 Jul 2024 14:49:33 GMT

@Rob Ingram

Ok great, Are Flexconfig changes non disrutive do you know .??

Thanks

Re: FMC Netflow Question

Rob Ingram — Wed, 24 Jul 2024 14:51:38 GMT

@benolyndav yes, I see no reason why there should be any impact. Obviously if you are concerned, deploy OOH in a change window.

Re: FMC Netflow Question

benolyndav — Thu, 25 Jul 2024 18:09:24 GMT

@Rob Ingram
Made the changes and I see the flow exporter and the packets sent counter is incremenring nicely but still no difference on our Monitoring system, Any ideas.?