In fact ASA NetFlow was initially not intended to be used for realtime/live traffic analysis (it was created for monitoring of security events)… But it is still a viable option for bandwidth monitoring. This option is fully supported in PRTG Network Monitor, including bandwidth computation, Top Talkers, Top Connections and Top Protocols!
Compared to "normal" NetFlow the following limitations apply:
- You will not see the real time data: The NSEL monitoring sends a NetFlow data packet only after a connection has been torn down. If a connection is active for minutes or hours, the ASA sends one NetFlow packet with the total of the connection. This causes peaks in PRTG’s graphs while showing too little traffic before that.
- Flows on the ASA are bidirectional (all counters for a flow will increase for traffic flowing in and out)
- NetFlow 9 monitoring on the ASA comes at a price: CPU load.
The following screenshot shows a comparison of the bandwidth monitoring results of three different techniques. It shows traffic through an ASA device measured using SNMP (traffic on the “WAN” port), NetFlow 9 (analyzing NetFlow 9 packets of the next Cisco router upstream) and again NetFlow 9 (NetFlow9 from the ASA itself).
SNMP / NetFlow / NetFlow Traffic Comparison (click to enlarge)