topic Re: HTTP Authentication on PIX - Syslog in Network Access Control

HTTP Authentication on PIX - Syslog

shane — Fri, 21 Feb 2020 18:10:08 GMT

I have Pix 515 running 6.3.3. I am authenticating my users on port 80 to a windows 2000 active directory. I am capturing the data in a syslog but it does not send what username they entered. It only records IP address. Is there a way to capture who logs in by user name in Syslog.

Re: HTTP Authentication on PIX - Syslog

ehirsel — Wed, 05 May 2004 11:14:30 GMT

You need to setup aaa accounting as well. It is done similar to defining a tacacs/radius server for user authentication. The user id, source and dest ip address info is sent in the accounting packet.

Re: HTTP Authentication on PIX - Syslog

dthompson — Wed, 05 May 2004 12:36:33 GMT

So when you turn on AAA accounting it will send the http request with the username and the destination of where these people are going on the internet to a syslog server?

I assumed that the aaa accounting packet was in a TACACS or Radius packet not the syslog information.

Re: HTTP Authentication on PIX - Syslog

ehirsel — Wed, 05 May 2004 16:54:29 GMT

The aaa accounting info will not be sent to the syslog server; only the aaa server. You may need to merge the info together - since most of it is redundant the aaa accounting info may be all that you need as it contains timestamps as well.

Re: HTTP Authentication on PIX - Syslog

Amin-Al — Tue, 11 May 2004 21:00:29 GMT

Yes, you can see the user authentication in the syslog messages. Just make sure you set the syslog level to the right one (I think informational).

Amin