internet ckt is saturated- FMC doesn't show the top use correctly.

[loc.nguyen]

Hi,

We have an issue that the internet is statured on a FTD.

It doesn't seem FMC tools can help figure out what causes it. Or I did not find the right place to look into it yet.

Could you advise?

Thanks

Loc

[Marvin Rhoads · Accepted solution]

Exporting Netflow data from your FTD is the best way to visualize and analyze the usage of your system on a per-user (or per-address actually in most cases) basis. I have used the free PRTG version for such cases before.

[loc.nguyen]

Thanks, Can we export Netflow data  via outside interface?

Is is possible if you send a link for that?

Thanks

Loc

[Marvin Rhoads]

Netflow data is exported from the diagnostic interface. However that traffic can be routed in your network back though the inside to the outside.

[loc.nguyen]

Hi,

I tried to set up netflow on an ASA in another city, outside interface. And export it to my home lab (99.x.x.22). I use PRTG in my lab. It did not work yet. Do you think it is ASA config need to check ?

flow-export destination outside 99.x.x.22 5555
flow-export template timeout-rate 15
flow-export delay flow-create 60

class-map flow_export_class
match any

policy-map global_policy
class flow_export_class
flow-export event-type all destination 99.x.x.22

service-policy global_policy global

Thanks

Loc

[Marvin Rhoads]

Check using the command "show flow-export counters". If that indicates flow records are being sent (run it more than once to see the number increment) then check a packet capture at the ASA (and possibly the PRTG server) to make sure the records are leaving the ASA outside interface and arriving at the server.