On 1/4/2016 4:57 μμ, Nikolaos Milas wrote:
> First impressions show that things work...
Actually, after about 12 hours of monitoring, I can see that nfsen does
not report ASA traffic correctly.
According to nfsen, our input / output rates (on main interface) were
2.2 / 1.2 Mbps respectively for some period, whereas from within ASA I
can see that the real rates should be at around 6 / 6 Mbps for the same
period.
The ifindex used for the interface is correct. It was confirmed both
with snmpwalk and from ASA CLI (using "show int det | i number|proto").
Am I doing something wrong? Should I configure something differently in
nfsen to analyze ASA exported data properly?
Currently I see that in ASA the following is configured:
flow-export template timeout-rate 30
flow-export active refresh-interval 5
class-map global-class
description NETFLOW
match access-list global_mpc
access-list global_mpc extended permit ip any any
policy-map global_policy
description NETFLOW_EXPORTER
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225 _default_h323_map
inspect h323 ras _default_h323_map
inspect rsh
inspect rtsp
inspect esmtp _default_esmtp_map
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options _default_ip_options_map
inspect http
inspect icmp
class global-class
flow-export event-type all destination 195.251.xxx.xxx
class class-default
user-statistics accounting
Please help me find a solution so that nfsen processes ASA data correctly!
Thanks,
Nick
------------------------------------------------------------------------------
Transform Data into Opportunity.
Accelerate data analysis in your applications with
Intel Data Analytics Acceleration Library.
Click to learn more.
http://pubads.g.doubleclick.net/gampad/clk?id=278785471&iu=/4140
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
