Enterasys Security Information and Event Manager, Configuration Manual

Page: 75 / 426

Configuring DSMs
Cisco ASA 59
For more information on forwarding NetFlow to SIEM, see your vendor
documentation.
Integrating Cisco
ASA for NetFlow
using NSEL
This section describes how to configure Cisco ASA to forward NetFlow events
using NSEL.
Step 1
Log in to the Cisco ASA device command line interface (CLI).
Step 2
Type the following command to access privileged EXEC mode:
enable
Step 3
Type the following command to access global configuration mode:
conf t
Step 4
Disable the output object name option:
no names
Step 5
Type the following command to enable NetFlow export:
flow-export destination <interface-name> <ipv4-address or
hostname> <udp-port>
Where:
<interface-name>
is the name of the Cisco Adaptive Security Appliance
interface for the NetFlow collector.
<ipv4-address or hostname>
is the IP address or host name of the Cisco
ASA device with the NetFlow collector application.
<udp-port>
is the UDP port number to which NetFlow packets are sent.
NOTE
SIEM typically uses port 2055 for NetFlow event data on Behavioral Flow
Collectors. You must configure a different UDP port on your Cisco Adaptive
Security Appliance for NetFlow using NSEL.
Step 6
Type the following command to configure the NSEL class-map:
class-map flow_export_class
Step 7
Choose one of the following traffic options:
a
To configure a NetFlow access list to match specific traffic, type the command:
match access-list flow_export_acl
b
To configure NetFlow to match any traffic, type the command:
match any
NOTE
The Access Control List (ACL) must exist on the Cisco ASA device prior to
defining the traffic match option in
Step 7 .
Step 8
Type the following command to configure the NSEL policy-map:
policy-map flow_export_policy