Hi, Below is the config of Internet Routers and ASA your reference..
Internet Router Config
**********************
ip flow-export source GigabitEthernet0/0
ip flow-export version 5
ip flow-export destination 172.22.5.17 9996
ip flow-export destination 172.22.64.35 9996
--------------------
interface GigabitEthernet0/0
description [ Internet connection to ISP]
ip address 116.212.XX.XX 255.255.255.252
ip access-group ACL-Internet in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in max-reassemblies 64
ip verify unicast source reachable-via rx allow-default 101
load-interval 30
duplex full
speed 1000
no mop enabled
-------------------
Internet_Router#sh ip flow export
Flow export v5 is enabled for main cache
Export source and destination details :
VRF ID : Default
Source(1) 116.212.XX.XX (GigabitEthernet0/0)
Source(2) 116.212.XX.XX (GigabitEthernet0/0)
Destination(1) 172.22.5.17 (9996)
Destination(2) 172.22.64.35 (9996)
Version 5 flow records
2016002805 flows exported in 67200602 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level
3 export packets were dropped due to no fib
62 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
=======================================
ASA Config
**********
Firewall/act/pri# sh run | i Netflow
object network Internet-Link-Netflow
object network Netflow-172.22.5.17
object-group service UDP_Netflow
access-list ACL-Internet extended permit object-group NETFLOW object Internet-Link-Netflow object Netflow-172.22.5.17 log
nat (Internet,Horizon) source static Internet-Link-Netflow Internet-Link-Netflow destination static IP-202.58.XX.XX Netflow-172.22.5.17
------------------------
Firewall/act/pri# sh run object id Internet-Link-Netflow
object network Internet-Link-Netflow
host 116.212.XX.XX
Firewall/act/pri# sh run object id Netflow-172.22.5.17
object network Netflow-172.22.5.17
host 172.22.5.17
Firewall/act/pri# sh object-group id UDP_Netflow
object-group service UDP_Netflow
service-object udp destination eq 2055
service-object udp destination eq 9996
----------------------------------
Firewall/act/pri# packet-tracer input Internet udp 116.212.XX.XX 1234 202.58.XX.XX 9996
Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (Internet,Horizon) source static Internet-Link-Netflow Internet-Link-Netflow destination static IP-202.58.XX.XX Netflow-172.22.5.17
Additional Information:
NAT divert to egress interface Horizon
Untranslate 202.58.XX.XX/9996 to 172.22.5.17/9996
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group ACL-Internet in interface Internet
access-list ACL-Internet extended permit object-group NETFLOW object Internet-Link-Netflow object Netflow-172.22.5.17 log
object-group service NETFLOW
service-object object NETFLOW_1
service-object object NETFLOW_2
Additional Information:
Phase: 3
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (Internet,Horizon) source static Internet-Link-Netflow Internet-Link-Netflow destination static IP-202.58.225.6 Netflow-172.22.5.17
Additional Information:
Static translate 116.212.XX.XX/1234 to 116.212.XX.XX/1234
Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 6
Type: SFR
Subtype:
Result: ALLOW
Config:
class-map SourceFire-Classify
match access-list Redirect-To-SourceFire
policy-map global_policy
class SourceFire-Classify
sfr fail-open monitor-only
service-policy global_policy global
Additional Information:
Phase: 7
Type: FOVER
Subtype: standby-update
Result: ALLOW
Config:
Additional Information:
Phase: 8
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
Phase: 9
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (Internet,Horizon) source static Internet-Link-Netflow Internet-Link-Netflow destination static IP-202.58.XX.XX Netflow-172.22.5.17
Additional Information:
Phase: 10
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:
Phase: 11
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 12
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 13
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:
Phase: 14
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 376486643, packet dispatched to next module
Result:
input-interface: Internet
input-status: up
input-line-status: up
output-interface: Horizon
output-status: up
output-line-status: up
Action: allow
