77-2
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter77 Configuring NetFlow Secure Event Logging (NSEL)
Information About NSEL
•Triggers flow-update events and generates appropriate NSEL data records.
•Defines and exports templates that describe the progression of a flow. Templates describe the format
of the data records that are exported through NetFlow. Each event has several record formats or
templates associated with it.
•Tracks configured NSEL collectors and delivers templates and data records to these configured
NSEL collectors through NetFlow over UDP only.
•Sends template information periodically to NSEL collectors. Collectors receive template
definitions, normally before receiving flow records.
•Filters NSEL events based on the traffic and event type through Modular Policy Framework, then
sends records to different collectors. Traffic is matched based on the order in which classes are
configured. After a match is found, no other classes are checked. The supported event types are
flow-create, flow-denied, flow-teardown, flow-update, and all. Records can be sent to different
collectors. For example, with two collectors, you can do the following:
–
Log all flow-denied events that match access list 1 to collector 1.
–
Log all flow-create events to collector 1.
–
Log all flow-teardown events to collector 2.
–
Log all flow-update events to collector 1.
•Delays the export of flow-create events.
Using NSEL and Syslog Messages
Table77-1 lists the syslog messages that have an equivalent NSEL event, event ID, and extended event
ID. The extended event ID provides more detail about the event (for example, which ACL—ingress or
egress—has denied a flow).
Note Enabling NetFlow to export flow information makes the syslog messages that are listed in Table77-1
redundant. In the interest of performance, we recommend that you disable redundant syslog messages,
because the same information is exported through NetFlow.
Table77-1 Syslog Messages and Equivalent NSEL Events
Syslog Message Description NSEL Event ID NSEL Extended Event ID
106100 Generated whenever an ACL is
encountered.
1—Flow was created (if the
ACL allowed the flow).
3—Flow was denied (if the
ACL denied the flow).
0—If the ACL allowed the flow.
1001—Flow was denied by the
ingress ACL.
1002—Flow was denied by the
egress ACL.
106015 A TCP flow was denied because
the first packet was not a SYN
packet.
3—Flow was denied. 1004—Flow was denied because
the first packet was not a TCP
SYN packet.
106023 When a flow was denied by an
ACL attached to an interface
through the access-group
command.
3—Flow was denied. 1001—Flow was denied by the
ingress ACL.
1002—Flow was denied by the
egress ACL.