New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

200.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


How do I monitor Cisco ASA Firewalls using NetFlow 9 and PRTG?

Votes:

1

Your Vote:

Up

Down

I would like detailed instructions on how to use Cisco's recently implemented NetFlow 9 in ASA 5500 security and firewall appliances.

asa cisco firewall howto netflow prtg sflow xflow

Created on Feb 26, 2010 11:30:36 AM by  Daniel Zobel [Paessler Support]

Last change on Apr 10, 2019 9:49:53 AM by  Maike Behnsen [Paessler Support]



1 Reply

Accepted Answer

Votes:

2

Your Vote:

Up

Down

This article applies to PRTG Network Monitor 12 or later

HowTo: Monitoring Cisco ASA Firewalls with PRTG using Netflow 9

Some time ago, Cisco has implemented NetFlow 9 for its popular ASA 5500 security and firewall appliances. But this implementation of NetFlow is quite different from what other Cisco devices provide. It is called "Netflow Security Event Logging" (NSEL) and was originally introduced on the Cisco ASA 5580. Now, with the latest firmware (ASA 8.2.x or later), it is now extended to other Cisco ASA models.

In fact ASA NetFlow was never intended to be used for realtime/live traffic analysis. On the Cisco forums web page the official statement is: "[...] NetFlow on the ASA does not provide the ability to see this data in realtime. The data can be collected after the flow has been terminated and analyzed but we do not support real time viewing of the NetFlow records. [...] The total bytes transferred can only be seen after the flow is torn down. [...] Lastly, all flows on the ASA are bidirectional. All counters for a flow will increase for traffic flowing from A->B or B->A. [...] NetFlow has a significant performance impact."

Nevertheless, the in-depth traffic information we are getting from the ASA using this technology is very very useful.

Bandwidth Monitoring using ASA Netflow Export and PRTG Network Monitor

You can analyze NetFlow 9 data from ASA since version 7.2 of PRTG Network Monitor. The setup is simple:

Step 1: Configure the ASA

The data to be exported is defined by a Service policy which brings flow data to the analyzer server. The following code works fine if your ASA still uses the default global policy (replace x.x.x.x with the IP adress of your PRTG installation and yy with the desired UDP port number).

policy-map global_policy
class class-default
flow-export event-type all destination x.x.x.x yy

If you are using the ASDM GUI, please go to Configuration-Firewall->Service Policy Rules and Click Add->select “Use class-default as the traffic class”->Next->Netflow (tab)->Add (check the collector(s) you want to use)->Finish->Apply.

This page on the cisco Tips website is helpful for NSEL.

Step 2: Set Up a NetFlow 9 Sensor in PRTG

In PRTG, navigate to the probe that will receive the NetFlow data packets (usually the "Local Probe"), click "Add Sensor", and choose "NetFlow V9" from the list of available sensor types. Click Next. Under "NetFlow 9 Specific Settings" please enter the UDP port ("yy" from the code above) and select the IP adress ("x.x.x.x" from the code above). Set Active Flow Timeout to zero (0).

Step 3: Netflow Monitoring of the ASA is online

That's it. Please note that it may take a few minutes before you can see results in the graphs.

SNMP / NetFlow / NetFlow Traffic Comparison

SNMP / NetFlow / NetFlow Traffic Comparison (click to enlarge)

What You Should Know About ASA Monitoring Using NetFlow 9

Please keep the following facts in mind:

  • You will not see the data 100% live: The NSEL monitoring sends a NetFlow data packet only after a connection has been torn down. If a connection is active for minutes or hours, the ASA sends one NetFlow packet with the total of the connection. This causes peaks in PRTG's graphs.
  • Flows on the ASA are bidirectional (all counters for a flow will increase for traffic flowing in and out)
  • If you need live traffic data please use SNMP Traffic Sensors on your ASA.
  • NetFlow 9 monitoring on the ASA comes at a price: CPU load. For most ASA with low to medium traffic this should not be an issue. But if your ASA already shows considerable CPU load think twice before using NetFlow.

Look at the sample graph above. It shows the traffic through an ASA device measured using three different techniques:

  • Via SNMP: Measuring the traffic on the "WAN" port of the ASA
  • Via NetFlow 9: By analyzing NetFlow 9 packets of the next Cisco router upstream
  • Via NetFlow 9: By analyzing NetFlow9 from the ASA itself

You can see that curves for "true" NetFlow 9 from the router (yellow) and for SNMP (green) are quite close to each other. The blue line for the ASA NetFlow tends to stay below the others and every once and a while it shows huge peaks. This always happens when a long running connection gets torn down and its complete bandwidth usage is shown in one peak. When you take the total (the "integral" of all three lines) the differences are marginal.

See Also

Monitoring Cisco ASA Firewalls using Netflow 9 and PRTG

Created on Feb 26, 2010 11:51:16 AM by  Daniel Zobel [Paessler Support]

Last change on Jun 9, 2017 3:35:38 PM by  Gerald Schoch [Paessler Support]



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.