Home / server / Questions / 503432
Accepted
Lance
Asked: 2013-04-29 22:51:32 +0800 CST

Cisco asa 5500 series - Logging VPN connections to easily search connection history

  • 772

We have a fresh requirement to log information to do with vpn connections.

The ultimate goal would be facilitating IT management being able to easily review when someone had been connecting / disconnecting over a period of time.

I have the information being syslogged to our NAS, but this doesn’t quite fit the bill due to the amount of information presented.

Do you know if there is an easy way for us to facilitate this or any tools that might parse the data?

Thanks in advance!

security

1 Answers

  1. Best Answer

    I have a Perl script that basic opens the log file and looks for the following

    fw.(Group = NETOPS_TUNNEL). (Username = .) (authenticated.) You can then spit the user name out into a variable and count.

    I would love to give you the code, but, its tightly integrated into a management toolkit that i wrote.

    To push the data to a syslog server you need the following commands.

    logging enable
logging timestamp
logging trap errors
logging host inside <syslog host>
logging message 113009 level errors
logging message 113008 level errors
logging message 113014 level errors
logging message 113004 level errors
logging message 713052 level errors
logging message 715019 level errors

    The above switches on logging, logs with a time stamp, sets logging to "error" and then sets where to send the logs.

    The other statements change the default level of certain log messages that might be useful for you. (Normally they are not logged at the error level)

    • 1