netflow not passing through the firewall

[jasmeet.guru]

Hi, 

I have configured flexible netflow on cisco 4351.  I want to sync it with Solarwinds using port 2055. its generating stats, but some how all the netflow information is not passing through Cisco ASA as it is not syncing with Solarwinds (showing never under last received netflow).

Below is the config:-

flow record FLOW_RECORD_IPv4
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect counter bytes
collect counter packets
!
!
flow exporter EXPORTER_A.B.C.D
destination A.B.C.D
transport udp 2055
!
!
flow monitor FLOW_MONITOR_IPv4
exporter EXPORTER_A.B.C.D
record FLOW_RECORD_IPv4
!
interface GigabitEthernet0/0/2
ip flow monitor FLOW_MONITOR_IPv4 input
ip flow monitor FLOW_MONITOR_IPv4 output

!

Also, On ASA i have applied access-list to permit udp traffic on port 2055. 

Suggestions please. Thanks in advance.

[Philip D'Ath]

Is the ASA perhaps NATing the source address so when it arrives it appears to have come from a different IP address than your router?

[jasmeet.guru]

Hi Philip, 

ASA is not NATing the source address from router, however the inside network (solarwinds address is NATed). I have applied the ACL for destination (solarwinds both Original and NATed address) to permit traffic from any source, no luck. 

What should be changed ?

[Florin Barhala]

Did you run the capture? What do you see there?

Instead of guessing we can review captured packet on different ASA interfaces.

[Florin Barhala]

On the same idea as Philip, can you run a capture on ASA on the EXIT interface aka 2nd interface and check traffic status.

[mahyatt]

Not sure if you ever solved this. I have seen where the FTD drops traffic when the source IP used to originate UDP traffic does not have a route to send traffic back to the interface that it received the traffic from.  The packet capture tool with trace can help identify this.