Configuring NSEL for ASA devices by using a CDO macro
ASAs report detailed connection event data using Netflow Secure Event Logging (NSEL). You can apply Secure Cloud Analytics to this connection event data, which includes bidirectional flow statistics. This procedure describes how to configure NSEL on an ASA device and send those NSEL events to a flow collector. In this case, the flow collector is a Secure Event Connector (SEC).
Summary
The key components involved in configuring NSEL for ASA devices are:
-
ASA device: Reports detailed connection event data using NSEL
-
Secure Event Connector (SEC): Acts as the flow collector that receives NSEL events
-
CDO macro: Automates the configuration process for NSEL settings
-
Flow-export destination: Defines where NSEL events are sent
-
Class-map: Defines which NSEL events will be sent to the SEC
-
Policy-map: Applies the flow-export configuration to specific traffic classes
Workflow
These are the stages of configuring NSEL for ASA devices by using a Security Cloud Control macro:
-
Before beginning the configuration process, gather the required information including the IPv4 address of the SEC, the ASA interface, the UDP port number, and the global policy name.
- IPv4 address of the SEC that will receive data from the ASA
- Interface on the ASA that will send data to the SEC
- UDP port number used to forward NetFlow events. See Finding your device's TCP, UDP, and NSEL port used for Secure Logging Analytics (SaaS).
- Determine the name of an ASA global policy
-
Execute the configuration workflow by following each step in sequence to properly configure NSEL using the CDO macro.
- Open the configuring NSEL macro.
- Define the destination of NSEL messages and the interval at which they are sent to the SEC.
- Create a Class-Map that defines which NSEL events will be sent to the SEC.
- Define a Policy-Map for NSEL events.
- Recommendation: disable redundant syslog messages when using NetFlow.
- Review and send the macro.
Here is an example of the Configure NSEL macro with all the default values filled in, a generic name for the class-map, and the class map added to the global_policy, When you are done with these procedures, your macro will resemble this:flow-export destination {{interface}} {{SEC_IPv4_address}} {{SEC_NetFlow_port}} flow-export template timeout-rate {{timeout_rate_in_mins}} flow-export delay flow-create {{delay_flow_create_rate_in_secs}} flow-export active refresh-interval {{refresh_interval_in_mins}} class-map {{flow_export_class_name}} match {{add_this_traffic_to_class_map}} policy-map {{global_policy_map_name}} class {{flow_export_class_name}} flow-export event-type {{event_type}} destination {{SEC_IPv4_address}} service-policy {{global_policy_map_name}} global logging flow-export-syslogs disable show run flow-export show run policy-map {{global_policy_map_name}} show run class-map {{flow_export_class_name}}flow-export destination {{interface}} {{SEC_IPv4_address}} {{SEC_NetFlow_port}} flow-export template timeout-rate 60 flow-export delay flow-create 55 flow-export active refresh-interval 1 class-map flow_export_class_map match any policy-map global_policy class flow_export_class_map flow-export event-type all destination {{SEC_IPv4_address}} logging flow-export-syslogs disable show run flow-export show run policy-map global_policy show run class-map flow_export_class_map