Configuring Flow-Export Action on Cisco ASA
Describe security monitoring and telemetry technologies
Which two commands are required when configuring a flow-export action on a Cisco ASA? (Choose two.)
Answer
Correct answer: A, D — Configure flow-export event-type and template timeout-rate to define export behavior.
Community Insight
The exam tests knowledge of ASA NetFlow configuration syntax, where candidates often confuse global policy-map application with the specific flow-export subcommands.
This question tests the specific CLI commands required to configure NetFlow export actions on a Cisco ASA firewall, focusing on event-type and template timeout settings.
Candidates frequently select B (policy-map) or E (access-group) because they are part of the broader NetFlow workflow, but they are not the direct 'flow-export action' configuration commands.
Community Discussion (10 comments)
XBfoundX
👍 1
Selected: AB
Guys do not get confused: ciscoasa(config)# access-list flow_export_acl permit ip host 209.165.200.224 host 209.165.201.224 ciscoasa(config)# class-map flow_export_class ciscoasa(config-cmap)# match access-list flow_export_acl ciscoasa(config)# policy-map flow_export_policy ciscoasa(config-pmap)# class flow_export_class ciscoasa(config-pmap-c)# flow-export event-type all destination 209.165.200.230 ciscoasa(config-pmap)# class class-default ciscoasa(config-pmap-c)# flow-export event-type all destination 209.165.201.29 ciscoasa(config)# service-policy flow_export_policy global https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html#examplesofnsel
XBfoundX
👍 1
The template is not needed, what is needed is, first matching the hosts that we want to monitor, so the flow_export_acl is the one that allows us to do so, then we need to create the class map putting there the ACL, why the class map is needed, well we need to inspect the traffic, so we have to do it via a class map. Then of course we need somehow a way to apply the class map, the class map cannot do nothing alone, so we need to create the POLICY MAP, in HERE we are putting the traffic inspected and in HERE we choose our netflow exporter, of course we have to apply the policy map globally, otherwise is not gonna be applied in the firewall interfaces.
Premium_Pils
👍 1
Selected: AB
These links are all valid for netflow on ASA: https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html#configureflowactions https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/monitor_nsel.html https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html https://support.solarwinds.com/SuccessCenter/s/article/NetFlow-Configuration-Example-Cisco-ASA I would say, the "flow-export event-type" and the "policy-map" are necessary commands for configuring flow-export actions. Changing the "flow-export template timeout-rate" is optional. The default value is 30 minutes. It is not necessary to change this. The flow-export actions would work with the default value.
IETF1
👍 2
AB https://support.solarwinds.com/SuccessCenter/s/article/NetFlow-Configuration-Example-Cisco-ASA
blacknblue8
👍 3
Selected: AB
https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html#configureflowactions
zamkljo
👍 1
Selected: AD
A. flow-export event-type D. flow-export template timeout-rate 15 These commands are used to specify the flow-export event type and configure the flow-export template timeout rate. The event type determines which events are exported, and the timeout rate specifies the frequency at which flow-export templates are sent.
fukumoto0925
👍 7
The solution looks correct (A&B) https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/monitor_nsel.html
Tuxzinator
👍 1
Selected: AD
A and d.. Not e
Tuxzinator
👍 1
Selected: AE
A and E. B not required
nickname202020
👍 8
read documents idiot.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To configure a flow-export action on a Cisco ASA, you must define how flows are exported and when templates are sent. The commandflow-export event-type specifies the events that trigger flow records (e.g., all, new-flow), and flow-export template timeout-rate defines the interval for sending template records. These are the two core components of the flow-export action configuration.Why the Other Options Are Wrong
Option B (policy-map) is used to apply class-maps to interfaces, which is a step in the overall process but not the flow-export action command itself. Option C (access-list) is used to match traffic within a class-map, not to configure the export action. Option E (access-group) applies security policies to interfaces. While these are necessary for end-to-end NetFlow functionality, the question specifically asks for the commands configuring the action.Community Comment Notes
Community consensus strongly supports options A and B in some contexts, but detailed analysis confirms A and D are the specific action commands. As user XBfoundX noted, the ACL and Class-Map are for matching, while the Policy-Map is for applying. However, the actual flow-export parameters are set viaflow-export event-type and flow-export template timeout-rate. Comments from Tuxzinator also highlight confusion between applying the policy versus configuring the action. Official Reference
Exam Strategy
Distinguish between configuration steps that match traffic (ACLs, Class-maps) and those that define the export behavior (Event-type, Template timeout). Focus on the exact command syntax for the feature being asked about.
Frequently Asked Questions
Why isn't policy-map a correct answer?
Policy-map is used to apply the class-map containing the flow-export action to an interface, but it does not configure the action's parameters like event type or timeout.
What is the difference between event-type and template timeout?
Event-type determines which traffic triggers flow records, while template timeout-rate controls how often template records are sent to the collector.