I would like detailed instructions on how to use Cisco's recently implemented NetFlow 9 in ASA 5500 security and firewall appliances.
This article applies to PRTG Network Monitor 12 or later
HowTo: Monitoring Cisco ASA Firewalls with PRTG using Netflow 9
Some time ago, Cisco has implemented NetFlow 9 for its popular ASA 5500 security and firewall appliances. But this implementation of NetFlow is quite different from what other Cisco devices provide. It is called "Netflow Security Event Logging" (NSEL) and was originally introduced on the Cisco ASA 5580. Now, with the latest firmware (ASA 8.2.x or later), it is now extended to other Cisco ASA models.
In fact ASA NetFlow was never intended to be used for realtime/live traffic analysis. On the Cisco forums web page the official statement is: "[...] NetFlow on the ASA does not provide the ability to see this data in realtime. The data can be collected after the flow has been terminated and analyzed but we do not support real time viewing of the NetFlow records. [...] The total bytes transferred can only be seen after the flow is torn down. [...] Lastly, all flows on the ASA are bidirectional. All counters for a flow will increase for traffic flowing from A->B or B->A. [...] NetFlow has a significant performance impact."
Nevertheless, the in-depth traffic information we are getting from the ASA using this technology is very very useful.
Bandwidth Monitoring using ASA Netflow Export and PRTG Network Monitor
You can analyze NetFlow 9 data from ASA since version 7.2 of PRTG Network Monitor. The setup is simple:
Step 1: Configure the ASA
The data to be exported is defined by a Service policy which brings flow data to the analyzer server. The following code works fine if your ASA still uses the default global policy (replace x.x.x.x with the IP adress of your PRTG installation and yy with the desired UDP port number).
policy-map global_policy class class-default flow-export event-type all destination x.x.x.x yy
If you are using the ASDM GUI, please go to Configuration-Firewall->Service Policy Rules and Click Add->select “Use class-default as the traffic class”->Next->Netflow (tab)->Add (check the collector(s) you want to use)->Finish->Apply.
This page on the cisco Tips website is helpful for NSEL.
Step 2: Set Up a NetFlow 9 Sensor in PRTG
In PRTG, navigate to the probe that will receive the NetFlow data packets (usually the "Local Probe"), click "Add Sensor", and choose "NetFlow V9" from the list of available sensor types. Click Next. Under "NetFlow 9 Specific Settings" please enter the UDP port ("yy" from the code above) and select the IP adress ("x.x.x.x" from the code above). Set Active Flow Timeout to zero (0).
Step 3: Netflow Monitoring of the ASA is online
That's it. Please note that it may take a few minutes before you can see results in the graphs.
SNMP / NetFlow / NetFlow Traffic Comparison (click to enlarge)
What You Should Know About ASA Monitoring Using NetFlow 9
Please keep the following facts in mind:
- You will not see the data 100% live: The NSEL monitoring sends a NetFlow data packet only after a connection has been torn down. If a connection is active for minutes or hours, the ASA sends one NetFlow packet with the total of the connection. This causes peaks in PRTG's graphs.
- Flows on the ASA are bidirectional (all counters for a flow will increase for traffic flowing in and out)
- If you need live traffic data please use SNMP Traffic Sensors on your ASA.
- NetFlow 9 monitoring on the ASA comes at a price: CPU load. For most ASA with low to medium traffic this should not be an issue. But if your ASA already shows considerable CPU load think twice before using NetFlow.
Look at the sample graph above. It shows the traffic through an ASA device measured using three different techniques:
- Via SNMP: Measuring the traffic on the "WAN" port of the ASA
- Via NetFlow 9: By analyzing NetFlow 9 packets of the next Cisco router upstream
- Via NetFlow 9: By analyzing NetFlow9 from the ASA itself
You can see that curves for "true" NetFlow 9 from the router (yellow) and for SNMP (green) are quite close to each other. The blue line for the ASA NetFlow tends to stay below the others and every once and a while it shows huge peaks. This always happens when a long running connection gets torn down and its complete bandwidth usage is shown in one peak. When you take the total (the "integral" of all three lines) the differences are marginal.