CHAPTER
1-1
Cisco ASA Series CLI Configuration Guide
1
Configuring NetFlow Secure Event Logging
(NSEL)
This chapter describes how to configure NSEL, a security logging mechanism that is built on NetFlow
Version 9 technology, and how to handle events and syslog messages through NSEL.
This chapter includes the following sections:
• Information About NSEL, page 1-1
• Licensing Requirements for NSEL, page 1-4
• Prerequisites for NSEL, page 1-4
• Guidelines and Limitations, page 1-4
• Configuring NSEL, page 1-5
• Monitoring NSEL, page 1-9
• Configuration Examples for NSEL, page 1-10
• Where to Go Next, page 1-11
• Additional References, page 1-11
• Feature History for NSEL, page 1-12
Information About NSEL
This section includes the following topics:
• Using NSEL and Syslog Messages, page 1-2
• Using NSEL in Clustering, page 1-3
The ASA and ASASM support NetFlow Version 9 services. For more information about NetFlow
services, see the “RFCs” section on page 1-12.
The ASA and ASASM implementations of NSEL provide a stateful, IP flow tracking method that exports
only those records that indicate significant events in a flow. In stateful flow tracking, tracked flows go
through a series of state changes. NSEL events are used to export data about flow status and are triggered
by the event that caused the state change.
The significant events that are tracked include flow-create, flow-teardown, flow-denied (excluding those
flows that are denied by EtherType ACLs), and flow-update. In addition, the ASA and ASASM
implementation of NSEL generates periodic NSEL events and flow-update events to provide periodic
To Next Page
Loading...
Need help?
General
