Cisco Systems Matching NetFlow Events to Configured Collectors

77-5
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter77 Configuring NetFlow Secure Event Logging (NSEL)
Configuring NSEL
Step5 To configure more collectors, repeat Step3 for each additional collector.
Step6 To change collector configuration details, select a collector and click Edit. To remove a configured
collector, select it and click Delete.
Step7 When NetFlow is enabled, certain syslog messages become redundant. To maintain system performance,
we recommend that you disable all redundant syslog messages, because the same information is exported
through NetFlow. To disable all redundant syslog messages, check the Disable redundant syslog
messages check box. To display the redundant syslog messages and their status, click Show Redundant
Syslog Messages.
The Redundant Syslog Messages dialog box appears. The Syslog ID field displays the redundant syslog
message numbers. The Disabled field indicates whether or not the specified syslog message is disabled.
Click OK to close this dialog box.
To disable individual redundant syslog messages, choose Configuration > Device Management >
Logging > Syslog Setup.
Step8 Click Apply to save your changes. Click Reset to enter new settings.
What to Do Next
See the “Matching NetFlow Events to Configured Collectors” section on page77-5.
Matching NetFlow Events to Configured Collectors
After you configure NetFlow collectors, you can match a NetFlow event with any of these configured
collectors.
To specify which NetFlow events should be sent to which collector, perform the following steps:
Step1 In the ASDM main application window, choose Configuration > Firewall > Service Policy Rules.
Step2 To add a service policy rule, perform the following steps:
a. Click Add to display the Add Service Policy Rule Wizard. For more information about service
policy rules, see the “Adding a Service Policy Rule for Through Traffic” section on page36-8.
b. Click the Global - applies to all interfaces radio button to apply the rule to the global policy. Click
Next.
c. Check the Source and Destination IP Address (uses ACL) check box or the Any traffic check box
as traffic match criteria, or click the Use class-default as traffic class radio button. Click Next to
continue to the Rule Actions screen.
Note NetFlow actions are available only for global service policy rules and are applicable only to the
class-default traffic class and to traffic classes with traffic match criteria of “Source and
Destination IP Address (uses ACL)” or “Any traffic.”
Step3 In the Rule Actions screen, click the NetFlow tab.