Netflow via ASA 5512 managemet interface

[mathewdevanny75576]

Hi there,

I have an ASA 5512 running 9.9(2)18, and I am trying to make it send Netflow traffic out of its management interface to collector in an adjacent subnet. I used a number of the simple tutorials available in the public domain.

It just won't work; although all of the routing configuration is in place, tcpdump on the collector shows me that no traffic from the ASA is coming in, even though ADSM shows that the ASA is sending plenty of UDP packets to that destination.

When I add a Netflow collector to the 'flow-export destination' that is on the inside interface however, that collector happily receives the traffic.

Are there any limitations about a 5512 sending Netflow traffic out of the management interface?

Mat

[sdemlow007]

I'm seeing this same behavior in one of our 5512-X, ver 9.12(3)12 as well. If I revert the code to the 9.8 train netflow works as expected out the MGMT interface. I ran PCAP's on the port the ASA was on and no packets destined for our netflow server showed up and yet were reported in the connections on the ASA itself.

[Marvin Rhoads]

That sounds like a bug. I'd recommend opening a TAC case. Please share the results here if you are able to do so.