Configuring Flow-Export Action on Cisco ASA
Short answer
AD Configure flow-export event-type and template timeout-rate to define export behavior.
Question
Key Takeaways
The exam tests knowledge of ASA NetFlow configuration syntax, where candidates often confuse global policy-map application with the specific flow-export subcommands.
This question tests the specific CLI commands required to configure NetFlow export actions on a Cisco ASA firewall, focusing on event-type and template timeout settings.
Common mistake: Candidates frequently select B (policy-map) or E (access-group) because they are part of the broader NetFlow workflow, but they are not the direct 'flow-export action' configuration commands.
Expert Analysis
Why the Answer Is Correct
To configure a flow-export action on a Cisco ASA, you must define how flows are exported and when templates are sent. The command flow-export event-type specifies the events that trigger flow records (e.g., all, new-flow), and flow-export template timeout-rate defines the interval for sending template records. These are the two core components of the flow-export action configuration.
Why the Other Options Are Wrong
Option B (policy-map) is used to apply class-maps to interfaces, which is a step in the overall process but not the flow-export action command itself. Option C (access-list) is used to match traffic within a class-map, not to configure the export action. Option E (access-group) applies security policies to interfaces. While these are necessary for end-to-end NetFlow functionality, the question specifically asks for the commands configuring the action.
Community Comment Notes
Community consensus strongly supports options A and B in some contexts, but detailed analysis confirms A and D are the specific action commands. As user XBfoundX noted, the ACL and Class-Map are for matching, while the Policy-Map is for applying. However, the actual flow-export parameters are set via flow-export event-type and flow-export template timeout-rate. Comments from Tuxzinator also highlight confusion between applying the policy versus configuring the action.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Distinguish between configuration steps that match traffic (ACLs, Class-maps) and those that define the export behavior (Event-type, Template timeout). Focus on the exact command syntax for the feature being asked about.
Frequently Asked Questions
Why isn't policy-map a correct answer?
What is the difference between event-type and template timeout?
Discussion 10 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 10
-
nickname202020 👍 8read documents idiot.
-
fukumoto0925 👍 7The solution looks correct (A&B) https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/monitor_nsel.html
-
blacknblue8 👍 3https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html#configureflowactions
-
IETF1 👍 2AB https://support.solarwinds.com/SuccessCenter/s/article/NetFlow-Configuration-Example-Cisco-ASA
-
Premium_Pils 👍 1These links are all valid for netflow on ASA: https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html#configureflowactions https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/monitor_nsel.html https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html https://support.solarwinds.com/SuccessCenter/s/article/NetFlow-Configuration-Example-Cisco-ASA I would say, the "flow-export event-type" and the "policy-map" are necessary commands for configuring flow-export actions. Changing the "flow-export template timeout-rate" is optional. The default value is 30 minutes. It is not necessary to change this. The flow-export actions would work with the default value.
Show 5 more comments
-
XBfoundX 👍 1Guys do not get confused: ciscoasa(config)# access-list flow_export_acl permit ip host 209.165.200.224 host 209.165.201.224 ciscoasa(config)# class-map flow_export_class ciscoasa(config-cmap)# match access-list flow_export_acl ciscoasa(config)# policy-map flow_export_policy ciscoasa(config-pmap)# class flow_export_class ciscoasa(config-pmap-c)# flow-export event-type all destination 209.165.200.230 ciscoasa(config-pmap)# class class-default ciscoasa(config-pmap-c)# flow-export event-type all destination 209.165.201.29 ciscoasa(config)# service-policy flow_export_policy global https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html#examplesofnsel
-
XBfoundX 👍 1The template is not needed, what is needed is, first matching the hosts that we want to monitor, so the flow_export_acl is the one that allows us to do so, then we need to create the class map putting there the ACL, why the class map is needed, well we need to inspect the traffic, so we have to do it via a class map. Then of course we need somehow a way to apply the class map, the class map cannot do nothing alone, so we need to create the POLICY MAP, in HERE we are putting the traffic inspected and in HERE we choose our netflow exporter, of course we have to apply the policy map globally, otherwise is not gonna be applied in the firewall interfaces.
-
zamkljo 👍 1A. flow-export event-type D. flow-export template timeout-rate 15 These commands are used to specify the flow-export event type and configure the flow-export template timeout rate. The event type determines which events are exported, and the timeout rate specifies the frequency at which flow-export templates are sent.
-
Tuxzinator 👍 1A and E. B not required
-
Tuxzinator 👍 1A and d.. Not e
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.