MARS and the new ASA version 8.2

Unanswered Question
May 18th, 2009

Can MARS parse the NSEL (netflow) output from a version 8.2 ASA appliance?

Should I send the output to MARS or wait for a MARS update?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (4 ratings)
Loading.
delawarecity Wed, 05/20/2009 - 05:37

Thanks for reply.

I forgot that the higher end ASA models were able to generate netflows at the 8.1 level. I guess the capability to parse v9 netflow was probably added to MARS at that time. The lower end models only received that capability in version 8.2. Since there was no 8.2 version to select in MARS, I wasn't sure if it would work correctly.

delawarecity Thu, 05/21/2009 - 05:42

Update:

I just received my first reports based on the netflow data from our ASA 5510. The ASA is generating netflow and MARS is parsing it correctly.

Actions

This Discussion