12-11-2019 01:37 AM - edited 12-11-2019 01:39 AM
Hi,
I'm new in stealthwatch so I don not if this is a normal behavior.
Stealthwatch report an peer IP address that do not exist.
The NetFlow sensor is a cisco ASA. The packet tracer on ASA do not report any communication with the
IP address dsiplayed by stealthwatch.
Waht is wrong ?
There is a way to deeper analys this behaivor?
Regards
Marco
Solved! Go to Solution.
12-12-2019 12:16 AM
Do you configure connection log for that session correctly in ASA?
I expect if Stealthwatch doesn’t have a log and ASA has a log of same session, it related to NetFlow missing issue because it’s UDP traffic. But this case is vice versa. Stealthwatch stitches before/after NAT IP with NSEL from ASA. Please double check log and configuration. If you still see same issue, I recommend to open case for troubleshooting.
12-12-2019 12:29 PM - edited 12-12-2019 12:30 PM
TAC open
12-12-2019 12:16 AM
Do you configure connection log for that session correctly in ASA?
I expect if Stealthwatch doesn’t have a log and ASA has a log of same session, it related to NetFlow missing issue because it’s UDP traffic. But this case is vice versa. Stealthwatch stitches before/after NAT IP with NSEL from ASA. Please double check log and configuration. If you still see same issue, I recommend to open case for troubleshooting.
12-12-2019 12:29 PM - edited 12-12-2019 12:30 PM
TAC open
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide