FMC Netflow Question

[benolyndav]

Hi

Recently upgraded to 7.0.6.2-65 and Netflow has stopped working any ideas why and if so Is there some instructions you can share for me to put this right again.??

Thankyou

[Rob Ingram]

@benolyndav yes, I see no reason why there should be any impact. Obviously if you are concerned, deploy OOH in a change window.

[benolyndav]

@Rob Ingram 
Made the changes and I see the flow exporter and the packets sent counter is incremenring nicely but still no difference on our Monitoring system, Any ideas.?

[Rob Ingram]

@benolyndav the interface you've configured the netflow destination can reach your NMS? Any ACL/Firewall inline that could block the traffic being received? If you took a packet capture on the NMS or switch, can you see communication on port 2055?

[benolyndav]

@Rob Ingram 

It was working fine untill after the upgrade. I dont think its actually sending but says it is.

another thing in the link you sent to configure NSEL step 2 is to configure an extended access list, but there isnt one and on our other FTDs that are working ok for Netflow there is no extended ACL on them. any  more thoughts on the issue

Thanks

[Rob Ingram]

@benolyndav I had a quick look at the bugs list, maybe this https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd60024

If not are you able to log a call with TAC?

Are you able to check to see whether netflow is at least sent to the NMS?

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html

check this link see if the FTD send the netflow or not 

MHM

[benolyndav]

@Rob Ingram 

In the Cisco NSEL doc it says to configure an extended access list, Do i need this in version 7.0.6 ??

Thanks

[Rob Ingram]

@benolyndav if it was working fine before the upgrade and other FTDs are working without using an extended access list, its possibly a bug. You can try using an extended access list and see if that resolves the issue, but as the issue has been going on for a long time I would recommend a TAC call or consider upgrade to 7.4.x as you do not need to use flexconfig, netflow is built into the GUI now.

[MHM Cisco World]

As a rule any flexconfig stop work after upgrading start search about if this op add to fmc ot not

I think this op add to fmc so no need more flexconfig and that why it stop

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center-virtual/221612-htz-01-2024-configure-netflow-in-fmc.html

MHM

[MHM Cisco World]

when you click it do you see the config or it disappear ?
MHM

[benolyndav]

Hi

Yes its there still