ASA Netflow Problem

[Daniel Acker]

I have a few ASA 5510 [8.4(3)] at different sites that are configured for netflow. They are sending flow data, however they do not seem to be complying with the timeout rates as specified:

flow-export template timeout-rate 1

If I initiate traffic, I see no flows in my NTA server until the traffic is fully transmitted. When they do appear, they are short bursts at rates that far exceed my available bandwidth instead of the gradual flow that actually took place.

Any ideas?

[Philip D'Ath]

That version of the code is getting a bit long in the tooth now.  Any chance of at least going to a gold star release like 8.4(7)?

[Daniel Acker]

I definitely plan to upgrade the code as maintenance windows permit, but I also don't buy "upgrade the code" as a resolution without a bug reference or at lease a mention somewhere else that the code level has an issue with the specific feature. 

[Philip D'Ath · Accepted solution]

8.4(7) is a "gold star" release, more of a "production" version of code.  It has had a lot more testing and is a strongly recommended release by Cisco.  You are not using what I could call "main stream" release code.  Personally I hardly ever run customers on ASA code not marked as "gold star".  

I just did a quick count up, and found 5 netflow bug fixes between your code version and the gold star release.  There were a total of 87 pages on my web browser of fixes from your release to the gold star release.  I also found this bug, which sounds very related to your issue.

CSCtt13455

netflow: template only send once with default timeout-rate

[Daniel Acker]

Well I stand corrected. Many thanks for your effort on my behalf. I'll see if I can't squeeze these upgrades into my next maintenance window.

[Philip D'Ath]

You are welcome.