Netflow on a ASA

[jef_rat72]

5505 ASA, 8.2(1)

We can not get it to report Netflow to the collection agent at 192.168.1.34.  Here is the commands I've entered:

asa# show run | i flow

access-list netflow-export extended permit ip any any

flow-export destination inside 192.168.1.34 2055

flow-export template timeout-rate 1

flow-export delay flow-create 60

class-map netflow-export-class

match access-list netflow-export

  flow-export event-type all destination 192.168.1.34

policy-map netflow-export-policy

class netflow-export-class

  flow-export event-type all destination 192.168.1.34

Any ideas?

[Maykol Rojas · Accepted solution]

The policy map needs to be applied globally, otherwise it wont work.

Would you please do a show run service-policy?

Doc

https://supportforums.cisco.com/docs/DOC-6113

Mike

[jef_rat72]

asa# show run service-policy

service-policy global_policy global

so it's blank. 

Here is what the config looks like now:

policy-map global_policy

class class-default

  flow-export event-type all destination 192.168.1.34

policy-map netflow-export-policy

class netflow-export-class

  flow-export event-type all destination 192.168.1.34

Should it look like this?:

policy-map global_policy

class class-default

class netflow-export-class

  flow-export event-type all destination 192.168.1.34

Never mind, I got it!  Thank you very much!

[Maykol Rojas]

Hi,

Now the config looks completely different from what you posted....

Do the following...

access-list netflow-export extended permit ip any any

  flow-export destination inside 192.168.1.34 2055

     flow-export template timeout-rate 1

class-map netflow-export-class

  match access-list netflow-export

policy-map global_policy

no class class-default

  class netflow-export-class

     flow-export event-type all destination 192.168.1.34

If After this it does not work, please do the following...

capture test interface inside match udp any any eq 2055

Wait for 2 seconds and then download them on pcap format

If you are located on the inside the way to do this would be as follows

http 0 0 inside

http server enable

Open a web browser and do the following

https://

Mike

[Maykol Rojas]

Oooook!

Nice

Mike

[jef_rat72]

to clarify the trick was cleaning up my global_policy 

So going from:

policy-map global_policy

class class-default

  flow-export event-type all destination 192.168.1.34

policy-map netflow-export-policy

class netflow-export-class

  flow-export event-type all destination 192.168.1.34

To:

policy-map global_policy

class class-default

class netflow-export-class

  flow-export event-type all destination 192.168.1.34

Thanks again.

[Maykol Rojas]

Yup,

Nice work.

Mike