ciscoasa# configure terminal
ciscoasa(config)# flow-export ?
configure mode commands/options:
active Configure Netflow parameters for active connections
delay Configure delay for exporting NetFlow events
destination Configure a destination to which NetFlow records will be sent
enable Enable the export of flow information through NetFlow
(deprecated)
template Specify the template specific configurations
ciscoasa(config)# flow-export destination ?
configure mode commands/options:
Current available interface(s):
inside Name of interface GigabitEthernet0/1
outside Name of interface GigabitEthernet0/0
ciscoasa(config)# flow-export destination inside ?
configure mode commands/options:
Hostname or A.B.C.D Destination IP address or name
ciscoasa(config)# flow-export destination inside 192.168.1.6 ?
configure mode commands/options:
<1-65535> UDP port number
ciscoasa(config)# flow-export destination inside 192.168.1.6 2055
ciscoasa(config)# flow-export template ?
configure mode commands/options:
timeout-rate Specify the time before templates are resent
ciscoasa(config)# flow-export template timeout-rate ?
configure mode commands/options:
<1-3600> Timeout in minutes (default 30 minutes)
ciscoasa(config)# flow-export template timeout-rate 5 // DEFAULT IS 30 MINS
ciscoasa(config)# flow-export delay ?
configure mode commands/options:
flow-create Specify delay after which flow creation event will be exported
ciscoasa(config)# flow-export delay flow-create ?
configure mode commands/options:
<1-180> Delay in seconds
ciscoasa(config)# flow-export delay flow-create 60
WARNING: The current delay flow-create value configuration may cause flow-update events to appear before flow-creation event. // JUST A WARNING FOR 5 SECOND DIFFERENCE WITH flow-export active refresh-interval VALUE
ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class class-default // MATCH ALL TRAFFIC
ciscoasa(config-pmap-c)# flow-export event-type all destination 192.168.1.6
ciscoasa(config-pmap-c)# end
ciscoasa# show run flow
flow-export destination inside 192.168.1.6 2055
flow-export template timeout-rate 5
flow-export delay flow-create 60
ciscoasa# show run policy-map
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect xdmcp
inspect netbios
inspect tftp
inspect ip-options
inspect pptp
inspect sip
class tcp-traffic
set connection advanced-options allow-probes
class class-default
flow-export event-type all destination 192.168.1.6
policy-map dynamic-filter_snoop_policy
class dynamic-filter_snoop_class
inspect dns dynamic-filter-snoop
!
ciscoasa# write memory
Building configuration...
Cryptochecksum: 9efb8040 ea39e168 2f4ab26e 3f75b246
105044 bytes copied in 1.210 secs (105044 bytes/sec)
[OK]
ciscoasa# show flow-export ?
counters Display flow-export run-time counters
ciscoasa# show flow-export counters
destination: inside 192.168.1.6 2055
Statistics:
packets sent 5514
Errors:
block allocation failure 0
invalid interface 0
template send failure 0
no route to collector 0
failed to get lock on block 0
source port allocation failure 0
Below is a snippet of the output in Solarwinds' NetFlow Traffic Analyzer (NTA).
There's no increase in ASA CPU utilization observed after NetFlow was enabled.
ciscoasa# show cpu usage
CPU utilization for 5 seconds = 4%; 1 minute: 4%; 5 minutes: 4%
ciscoasa# show processes cpu-usage
Hardware: ASA5515
Cisco Adaptive Security Appliance Software Version 9.8(4)10
ASLR enabled, text region 7f6204493000-7f6208801234
PC Thread 5Sec 1Min 5Min Process
0x0000560200394ce3 0x00007f4ac6ad7880 0.0% 0.0% 0.0% zone_background_idb
0x00005602010644ed 0x00007f4ac6acce20 0.0% 0.0% 0.0% webvpn_task
0x00005601ffbb58c8 0x00007f4ac6af27e0 0.0% 0.0% 0.0% WebVPN KCD Process
0x0000560200ec7b92 0x00007f4ac6ad9920 0.0% 0.0% 0.0% vpnlb_timer_thread
0x0000560200ec7dca 0x00007f4ac6adf020 0.0% 0.0% 0.0% vpnlb_thread
0x0000560200eab718 0x00007f4ac6abf840 0.0% 0.0% 0.0% vpnfol_thread_unsent
0x0000560200eab5c5 0x00007f4ac6abff80 0.0% 0.0% 0.0% vpnfol_thread_timer
0x0000560200eab058 0x00007f4ac6abfbe0 0.0% 0.0% 0.0% vpnfol_thread_sync
0x0000560200eaac2f 0x00007f4ac6ac0320 0.0% 0.0% 0.0% vpnfol_thread_msg
0x00005601ff7f61e8 0x00007f4ac6ad3000 0.0% 0.0% 0.0% VPN director state sync
<OUTPUT TRUNCATED>
ciscoasa# show processes cpu-usage | exclude 0.0
Hardware: ASA5515
Cisco Adaptive Security Appliance Software Version 9.8(4)10
PC Thread 5Sec 1Min 5Min Process
- - 4.6% 3.9% 4.1% DATAPATH-0-1386
<OUTPUT TRUNCATED>