In fact ASA NetFlow was initially not intended to be used for realtime/live traffic analysis (it was created for monitoring of security events)… But it is still a viable option for bandwidth monitoring. And with PRTG Network Monitor V7.2 this option is fully supported, including bandwidth computation, Top Talkers, Top Connections and Top Protocols!
Compared to "normal" NetFlow the following limitations apply:
- You will not see the real time data: The NSEL monitoring sends a NetFlow data packet only after a connection has been torn down. If a connection is active for minutes or hours, the ASA sends one NetFlow packet with the total of the connection. This causes peaks in PRTG’s graphs while showing too little traffic before that.
- Flows on the ASA are bidirectional (all counters for a flow will increase for traffic flowing in and out)
- NetFlow 9 monitoring on the ASA comes at a price: CPU load.
The following screenshot shows a comparison of the bandwidth monitoring results of three different techniques. It shows traffic through an ASA device measured using SNMP (traffic on the “WAN” port), NetFlow 9 (analyzing NetFlow 9 packets of the next Cisco router upstream) and again NetFlow 9 (NetFlow9 from the ASA itself).

SNMP / NetFlow / NetFlow Traffic Comparison (click to enlarge)
More
Our Knowledge Base article How to monitor Cisco ASA Firewalls using Netflow 9 and PRTG? explains how to configure the ASA and PRTG and all the other details you need to know.
Add comment