Hi,
I have a question about the Netflow functionality in Cisco ASA 5500 series.
The netflow traffic data is reported correct, if there is no VPN users connected to the network through ASA.
When VPN users connect to the Network through VPN , netflow export from ASA shows VPN traffic as multiple times the real value. This leads to incorrect spikes in traffic.
Please let me know if this is a known bug/limitation in ASA.
FYI,
Network setup is as below.
ISP connects to the ASA firewall. ASA to the VPN router. The tunnel ends at the router interface, so the VPN traffic is a 'pass through' traffic for ASA. Netflow export from the VPN router is perfect. Only ASA export shows spikes.
