ASA Netflow support

Question

Cisco ASAs support a version of netflow called NetFlow Secure Event Logging (NSEL). Is special support for the protocol required on the collectors to view the flows? Is the protocol compatible with traditional netflow collectors? In my implementation I am planning on only sending the successful flows to the collector.

Answer 1

Our ASAs (version 8.2(x)) send to a SolarWinds Orion collector using Netflow version 9. We didn't have to do anything special to get it to work. SolarWinds has a doc with a good explanation of the differences between "normal" and "ASA" Netflow here: http://www.solarwinds.com/documentation/Netflow/docs/understandingciscoasanetflow.pdf.

If it helps here is a sample configuration:

access-list flow_export_acl extended permit ip any any
flow-export destination inside collector_IP_address 2055
flow-export template timeout-rate 1
flow-export delay flow-create 15
class-map flow_export_class
 match access-list flow_export_acl
 description Netflow
 class flow_export_class
  flow-export event-type all destination collector_IP-address

Answer 2

NSEL records are only sent during flow creation, teardown, or ACL deny events and utilizes NetFlow v9 fields and templates. Here is a Doc that Cisco has about Netflow on the ASA and at the end it talks about collector interoperability. I personally have used Scrutinizer and everything worked perfectly.

Edit: Also Plixer did a "deep dive" on What NSEL is.

Answer 3

I've used netflow on ASAs before, and it only requires v9 compatability on your collector.