How to configure NetFlow on Cisco devices with Firepower Management Center

These instructions assume:

• You’re running Firepower Management Center (FMC) software version 6.2 or higher.
• Firepower Threat Defence (FTD) devices are connected to your FMC device.
• The date, time and time zone are correctly set on the Firepower devices.
• You have login credentials and admin access to your Firepower Management Center.
• The IP address of your Auvik collector is known.

If you are using a shared collector and want TrafficInsights to associate flow data with the correct site, you must add the source IP address as a dedicated /32 network within Auvik.

For example:

192.168.1.10/32

Even if the source IP address is already included in a larger monitored subnet, a dedicated /32 entry is required for TrafficInsights to correctly associate flow records with the appropriate site.

After making this change, it may take several minutes before flow data appears in TrafficInsights.

Set the Auvik collector parameters

1. Navigate to Objects
2. Click on Objects Management
3. Click on FlexConfig
4. Click on Text Object
5. Edit the netflow_Destination object
   
   
6. In this variable, set the interface sending Netflow, the Auvik collector IP address, and the port

Note: You need to change the count to 3, it is 1 by default.

Create the FlexConfig Policy

1. Navigate to Device
2. Click on FlexConfig
3. Click on New Policy
4. Give a name to the policy
5. Select the Firewall(s) to receive the policy
6. Click Save
   
   
7. Select the objects: Netflow_Add_Destination and Netflow_Set_Parameters
   It will look like this:
   
8. Click Save
9. Deploy on the target firewall
10. Go to the Auvik portal
11. Click on TrafficInsights
12. Approve the flow

You may see a message in TrafficInsights informing you that no templates are being sent from the device. Do not troubleshoot it right away. Wait for about 30 to 60 minutes and check it again.