Enhanced Cisco ASA NSEL Reporting in NetFlow Analyzer

NetFlow is a Cisco proprietary protocol the primary purpose of which is to collect all IP traffic on and send the traffic as UDP packets to NetFlow collector server(or NetFlow Analyzer). It helps Administrators to analyze network traffic and generate reports on bandwidth usage, traffic volume, conversations etc. It also helps in capacity planning to accommodate future growth.

Initially, NetFlow was introduced in major Cisco routers and core switches to analyze traffic. With growing business needs, more vulnerabilities arose due to security threats on the network led to the birth Cisco Adaptive Security Appliances also known as ASA.

With the facing off of Cisco PIX, it is now an era of Cisco ASA with more enhancements. NSEL (NetFlow Secure Event Logging) support in Cisco ASA helps analyze the traffic pattern and allied security threats which was not available in the earlier Firewall Device (PIX) that supported only Syslog analysis

NSEL reporting is different from regular NetFlow, the NetFlow packets from the Cisco ASA are triggered only when an event is created on the device. The event types that trigger the NetFlow records are:

• Flow Creation

• Flow Denial

• Flow Teardown

Enhanced Report:-

The Cisco ASA NetFlow reporting in NetFlow Analyzer will show the traffic heading to WAN with their LAN IP address as well their corresponding mapped NAT-ed IP address on the Firewall. 

The troubleshooting report for ASA interfaces will show the regular LAN traffic conversation with their corresponding mapped NAT-ed IP address conversation for each interfaces. The report will also show the Event types for each flow.

Points to ponder:

When it comes to Cisco ASA, NetFlow packets are exported based on events triggered on the device and is called NSEL (NetFlow Secure Event logging) which come with some inherent challenges. The information from these NetFlow packets cannot be used for complete bandwidth or capacity planning due to certain differences with traditional NetFlow (ie. IOS NetFlow) export. And these differences pose some limiting factors that one may want to consider, like:

1. The concept of ‘active time out’ and ‘inactive timeout’, which allows flow data export in a timely manner from IOS devices, does not exist for NetFlow packets exported from the Cisco ASA. This removes the possibility of comparing NetFlow statistics with other bandwidth monitoring tools which are based on timely polling for data.

2. NetFlow packets exported from the device is based on events triggered on the device (Flow creation, Denial of traffic etc).

3. The NetFlow packets exported from the Cisco ASA includes bidirectional traffic information which means that the return traffic of an initiated conversation is not accounted as a separate conversation.

Hope there will be some more enhancements to overcome the above said points in the near future. Click here to know how to configure ASA for NetFlow export.

For 30 Day Trial, click Download now.

Thanks and Regards

Praveen Kumar