0

I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx 10 Mbps with spikes up to almost 100 Mbps, and I'm trying to figure out what is causing the bandwidth spikes.

I'm looking for a way to see a list of hosts ordered by the amount of bandwidth presently being used so I can determine which hosts are using the most bandwidth and use that info to hunt down the applications generating the bandwidth spikes.

I've done some research and it looks like Netflow would give me what I'm looking for, but it doesn't appear that ASAs support Netflow.

Improve this question

3 Answers 3

Reset to default
0

This is not a feature of the ASA 5505. What I suggest is to set up ACL's to match the traffic (and allow it), and set them to notification logging.

Then set up syslog against a Splunk instance (you can get a free install for a limited amount of daily data) and use Splunk to see the usage.

Improve this answer
2
  • I already have the ASA logging to a syslog instance, so what you're suggesting shouldn't be hard at all to accomodate. However, based on what I understand of the way ASAs log ACL matches it just reports that the ACL was matched and doesn't give any data as to how much data was transferred. Am I wrong here? Also, I noticed you said ASA5505 but what I have is a ASA5515 which as I understand it is a generation newer. Does your comment still hold true?
    – vrtigo1
    Nov 27, 2014 at 22:57
  • @vrtigo1 no, you can log the connection statistics as well. I'm not very into details on this one, but the ASA does have plenty of logging if you enable it all (TCP teardown etc - it shows how much traffic each session used)
    – pauska
    Nov 28, 2014 at 9:53
0

If your servers / devices support SNMP then you can run MRTG on the individual devices / interfaces to monitor them individually. You can do this with Windows, Linux, Mac. Setting it up and maintaining it's a pain as you need to update your config any time devices change, but it can be worth it to isolate issues like what you've described.

Improve this answer
1
  • While I agree this could work if all I had to worry about were servers or other stationary devices, it's unfortunately not practical for me because I have a significant number of transient end user devices (tablets, smartphones, etc) as well as devices that we don't control (i.e. guest systems).
    – vrtigo1
    Nov 28, 2014 at 2:06
0

Unfortunately, the folks who have already posted are wrong on this one. You are correct, you are looking for Netflow and it is supported by the ASAs. See the links below on how to get started.

ASA 5500 9.1 CLI Config Guide:

ASA 5500 9.1 ASDM Config Guide:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .