topic Re: Netflow on a ASA in Network Security

Netflow on a ASA

jef_rat72 — Mon, 11 Mar 2019 21:15:58 GMT

5505 ASA, 8.2(1)

We can not get it to report Netflow to the collection agent at 192.168.1.34. Here is the commands I've entered:

asa# show run | i flow

access-list netflow-export extended permit ip any any

flow-export destination inside 192.168.1.34 2055

flow-export template timeout-rate 1

flow-export delay flow-create 60

class-map netflow-export-class

match access-list netflow-export

flow-export event-type all destination 192.168.1.34

policy-map netflow-export-policy

class netflow-export-class

flow-export event-type all destination 192.168.1.34

Any ideas?

Netflow on a ASA

Maykol Rojas — Tue, 23 Aug 2011 17:57:13 GMT

The policy map needs to be applied globally, otherwise it wont work.

Would you please do a show run service-policy?

Doc

https://supportforums.cisco.com/docs/DOC-6113

Mike

Re: Netflow on a ASA

jef_rat72 — Tue, 23 Aug 2011 18:03:51 GMT

asa# show run service-policy

service-policy global_policy global

so it's blank.

Here is what the config looks like now:

policy-map global_policy

class class-default

flow-export event-type all destination 192.168.1.34

policy-map netflow-export-policy

class netflow-export-class

flow-export event-type all destination 192.168.1.34

Should it look like this?:

policy-map global_policy

class class-default

class netflow-export-class

flow-export event-type all destination 192.168.1.34

Never mind, I got it! Thank you very much!

Netflow on a ASA

Maykol Rojas — Tue, 23 Aug 2011 18:15:09 GMT

Hi,

Now the config looks completely different from what you posted....

Do the following...

access-list netflow-export extended permit ip any any

flow-export destination inside 192.168.1.34 2055

flow-export template timeout-rate 1

class-map netflow-export-class

match access-list netflow-export

policy-map global_policy

no class class-default

class netflow-export-class

flow-export event-type all destination 192.168.1.34

If After this it does not work, please do the following...

capture test interface inside match udp any any eq 2055

Wait for 2 seconds and then download them on pcap format

If you are located on the inside the way to do this would be as follows

http 0 0 inside

http server enable

Open a web browser and do the following

https://

Mike

Netflow on a ASA

Maykol Rojas — Tue, 23 Aug 2011 18:15:53 GMT

Oooook!

Nice

Mike

Re: Netflow on a ASA

jef_rat72 — Tue, 23 Aug 2011 18:18:41 GMT

to clarify the trick was cleaning up my global_policy

So going from:

policy-map global_policy

class class-default

flow-export event-type all destination 192.168.1.34

policy-map netflow-export-policy

class netflow-export-class

flow-export event-type all destination 192.168.1.34

To:

policy-map global_policy

class class-default

class netflow-export-class

flow-export event-type all destination 192.168.1.34

Thanks again.

Netflow on a ASA

Maykol Rojas — Tue, 23 Aug 2011 18:21:11 GMT

Yup,

Nice work.

Mike