I just got a couple of ISR 4431 routers to replace our existing internet routers and I would like to send netflow records to our Prime Infrastructure 3 server.  Each router will only use two interfaces, an inside to our firewall and and outside to our ISP. Question 1)  After doing some reading, I am planning on just collection input and output flows on the ISP-facing interface.  I thought about collecting input flows on both interfaces, but it doesn't seem necessary.  This router will only ever have and inside and outside interface.  Would anyone have any reasons why I should collect input on both interfaces as opposed to input/output on the outside? Question 2) I don't know if I should use "match flow direction" or "collect flow direction" when I set up my record.  Some examples use "match" and some use "collect".  I tried to think about it logically, and it doesn't seem like it would matter in the end, but if anyone has any thoughts on this, it would be helpful. Thanks for any help that you can give.  It is much appreciated. Allen ... View more

Does anyone know why band 3 is blocked by default? Is it OK to enable it, and are the any advantages or disadvantage to doing so for an indoor network? Thanks, Allen ... View more

What is the purpose of "dfs band 3 block"? Do I want/need to block band 3 for indoor wireless networks? Any advantages/disadvantages of unblocking it? Thanks, Allen ... View more

This is my first, in what may be a series of netflow questions. I just received a couple of ISR 4331 routers.  We are going to use these as internet routers for our company. I would like to set up Flexible Netflow v9 with NBAR support to send to our Cisco Prime Infrastructure server. The router will only have a port-channel interface on the inside and a single outside interface. My question is: most documentation suggests monitoring ingress flows on both interfaces.  Would there be any advantages or disadvantages to just monitoring ingress and egress flows on a single interface if there are only going to be two interfaces and we are just doing simple internet routing. Thanks, Allen ... View more

I have an office with one outside IP address and two internal servers. I currently have an object nat for SERVER1 (HTTPS) to OUTSIDE (8443) and object nat for SERVER2 (HTTP) to OUTSIDE (8080) I want to add SERVER2 (HTTPS) to OUTSIDE (8444) because SERVER2 needs web and secure web for a while. My question is, should I: 1) Create another object for SERVER2 and create another object nat, for my new port or 2) Create a regular static nat rule, or 3) Change then existing rules to static nat rules and also create the new one as a static nat rule? Do most people use object nat for everything or static nat for everything, or object for the first and then static for the rest?  I'm just looking to follow a standard that most people use.   Thanks, Allen   ... View more

I wanted to start looking at IPV6.  Does anyone know, in general, if most companies will be using routed (NAT) mode or transparent mode when they move to IPV6.  It seems that if I keep my ASA in routed mode, then I can run a dual-stack setup.  However, I would then have to NAT my IPV6 traffic.  If I switch to transparent mode, I can make use of all of my IPV6 addresses, but I don't think that I can run a dual-stack in that case, usless I set up another device to do my NATting.  Am I correct?  What will the general trend be? Thanks, Allen ... View more