Cisco FirePower Reporting - Bandwidth Statistics

[John5mith]

Hi All,

I was hoping someone could shed some light on how I can create a bandwidth report to show utilization stats for traffic entering the inside interface and existing the outside interface on my Cisco Firepower ASA.

I currently have a 'Connection Summary Data' report showing Traffic (KB/s) against Time (see 'Report Parameters' attached) but this looks like an aggregated report for all interfaces as the KB/s shown in the report (see 'Report Output' attached) look like it is way above our Internet line speed. So I was wondering whether there was any way which a report could be created to show only traffic existing the outside interface?

Thanks,
John

[Marvin Rhoads · Accepted solution]

I don't think you can do that with FMC.

I'd suggest doing Netflow on the ASA itself and using a Netflow collector like PRTG, ManageEngine etc. to create your reports.

[John5mith]

Thanks Marvin. You would think that this should be possible as it seems the device is logging this data. Do you know whether anything is possible with the use of estreamer combined with a 3rd party application or is this purely for security event reporting?

[Marvin Rhoads]

You're welcome.

You're right - one would think this would be a simple query that they would have pre-built reports for the administrator to use. I gave similar feedback to Cisco just last week.

AFAIK, eStreamer cannot be used for this purpose. Per the eStreamer Integration Guide:

The service can stream the following categories of data:

• Intrusion event data and event extra data

• Correlation (compliance) event data

• Discovery event data

• User event data

• Metadata for events

• Host information

• Malware event data

Source:

http://www.cisco.com/c/en/us/td/docs/security/firepower/621/api/eStreamer/EventStreamerIntegrationGuide_621/Intro.html

[John5mith]

Thanks again much appreciated!

[guibarati]

I stubbed upon this question looking for something else, but here is how I do it:

Go to Analysis -> Connection Events, Click Edit Search, configure the search constrain to specific Zone/Interfaces (ingress or egress).

The, select the time period you want to sample, Click on "Switch Workflow", select the option "Traffic over time"

This should give you the graph you are looking for.

[Austin Clark]

This only works if you are logging all traffic as connection events. 

[guibarati]

This is correct. with the workflow the FMC will show you the information based on the "connection events" table. It will show you an aggregate graph of the "initiator bytes" or "responder bytes" depending on the graph you select.

Another thing I found out since my post is that you can't filter traffic based on source or destination zones for the graphs. You can use source/destination zones on the connection events table, but not on the graphs.

When you open the "search" page for the connection events it will show you an asterisk "*" on the fields that can be used as search constrains on the graphs and src/dst zones are not one of them. So you would have to use something like the subnet IPs that are related to each zone to get the bandwidth for specific zone pairs.

[cyborgzhouse]

I have traffic graphing on the Firepower Threat devices. You have to use the LINA OS partition using the FTD management interface.

This works on everything except the Azure or AWS virtual FTD's. I use CACTI for traffic graphing.

Chris