Create a Class-Map that defines which NSEL events will be sent to the SEC

Create a class-map that identifies NSEL traffic for export to the SEC and define the matching criteria for traffic classification.

The following commands in the macro group all NSEL events in a class and then export that class to the Secure Event Connector (SEC). These instructions refer to this section of the macro:

class-map {{flow_export_class_name}}

match {{add_this_traffic_to_class_map}}

Procedure

Step 1

The class-map command names the class map that identifies NSEL traffic that will be exported to the SEC.

{{flow-export-class-name}}-Enter a name for your class map. The name may be up to 40 characters in length. The names "class-default" and any name that begins with "_internal" or "_default" are reserved. All types of class maps use the same name space, so you cannot re-use a name already used by another type of class map.

Step 2

Identify the traffic that is going to be associated with (matched with) your class-map. Choose one of these options for the value of {{add_this_traffic_to_class_map}}:

Enter any in the {{add_this_traffic_to_class_map}} field. This monitors all traffic types for NSEL traffic. We recommend using the value "any".
Enter access-list name-of-access-list in the {{add_this_traffic_to_class_map}} field. This associates all the traffic associated with an access-list that you have created. See Configure Flow-Export Actions Through Modular Policy Framework in the Cisco ASA NetFlow Implementation Guide for more information.

Continue to Define a Policy-Map for NSEL events.

You have created a class-map that defines which NSEL events will be sent to the SEC and specified the traffic matching criteria.