Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

MARS and the new ASA version 8.2

Can MARS parse the NSEL (netflow) output from a version 8.2 ASA appliance?

Should I send the output to MARS or wait for a MARS update?

7 REPLIES

Re: MARS and the new ASA version 8.2

Yes it does, please check Table 2 on the following link:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/compatibility/local_controller/dtlc60x.html

Please rate if helpful.

Regards

Farrukh

Community Member

Re: MARS and the new ASA version 8.2

Thanks for reply.

I forgot that the higher end ASA models were able to generate netflows at the 8.1 level. I guess the capability to parse v9 netflow was probably added to MARS at that time. The lower end models only received that capability in version 8.2. Since there was no 8.2 version to select in MARS, I wasn't sure if it would work correctly.

Re: MARS and the new ASA version 8.2

Are you sure that 8.2 supports netflow for the lower ASA models? I don't see this mentioned in the release notes:

http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.html#wp229690

Regards

Farrukh

Community Member

Re: MARS and the new ASA version 8.2

Check this link:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_bulletin_c25-526545.html

Cut and paste from article:

Cisco NetFlow Secure Event Logging: This feature was originally introduced on the Cisco ASA 5580, and is now extended to other Cisco ASA models to provide administrators with more comprehensive event logging information.

Re: MARS and the new ASA version 8.2

Ahh ok, I hope its true :)

Thanks for the link.

Regards

Farrukh

Community Member

Re: MARS and the new ASA version 8.2

Update:

I just received my first reports based on the netflow data from our ASA 5510. The ASA is generating netflow and MARS is parsing it correctly.

Re: MARS and the new ASA version 8.2

Thanks for the update :)

Regards

Farrukh

249
Views
20
Helpful
7
Replies
CreatePlease to create content