Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Pass Through VPN Tunnel traffic creates invalid netflow export in ASA 5500 series

Hi,

I have a question about the Netflow functionality in Cisco ASA 5500 series.

The netflow traffic data is reported correct, if there is no VPN users connected to the network through ASA.

When VPN users connect to the Network through VPN , netflow export from ASA shows VPN traffic as multiple times the real value. This leads to incorrect spikes in traffic.

Please let me know if this is a known bug/limitation in ASA.

 

FYI,

Network setup is as below.

ISP connects to the ASA firewall. ASA to the VPN router. The tunnel ends at the router interface, so the VPN traffic is a 'pass through' traffic for ASA. Netflow export from the VPN router is perfect. Only ASA export shows spikes.

Everyone's tags (1)
1 REPLY
New Member

To be clear, this is just VPN

To be clear, this is just VPN pass-through traffic over the ASA, there is no VPN router.

 

infrastructure looks like this:

Desktop user using software VPN client to customer > 6509-E switch > ASA > internet > customer VPN endpoint

 

Cisco TAC for this case is 632018113

 

Thanks,


Paul

128
Views
0
Helpful
1
Replies
CreatePlease to create content