topic VPN 3005 Logging in Network Security

VPN 3005 Logging

sciarrino — Fri, 21 Feb 2020 09:23:35 GMT

I would like to keep a simple log of who

VPNs into the my 3005.

Does anyone have a solution to do this?

Re: VPN 3005 Logging

Collin Clark — Tue, 30 Jan 2007 19:38:17 GMT

Are the userd local or are you using RADIUS/TACACs?

Re: VPN 3005 Logging

sciarrino — Tue, 30 Jan 2007 20:19:17 GMT

Right now it is set to NT domain.

I guess I could use IAS on Windows server.

I'm looking into maybe sysloging everything and then see if Kiwi syslog can filter it?

scott

Re: VPN 3005 Logging

Collin Clark — Tue, 30 Jan 2007 20:24:34 GMT

You could use your event logs, which stinks. IAS would be better. Let me see what the syslog looks like and we'll see if Kiwi can filter or if we have to write a script.

Re: VPN 3005 Logging

Collin Clark — Tue, 30 Jan 2007 20:49:36 GMT

The syslog is pretty good. Here's an example:

2007-01-30 14:45:19 Local7.Notice 172.16.255.254 63161228 01/30/2007 14:45:33.000 SEV=4 AUTH/22 RPT=41714 70.226.xx.xx User [DOMAIN\my_id] Group [vpn-group] connected, Session Type: IPSec

You can filter on "connected" in Kiwi. Note that you will also get disconnect notices with that filter. If you really just want connections, filter on something longer like "[vpn-group] connected"

HTH and please rate.

Here's a disconnect for reference:

2007-01-30 14:45:24 Local7.Notice 172.16.255.254 63161427 01/30/2007 14:45:38.460 SEV=4 AUTH/28 RPT=40305 70.226.xx.xx User [DOMAIN\my_id] Group [vpn-group] disconnected: Session Type: IPSec/NAT-T Duration: 0:00:05 Bytes xmt: 56 Bytes rcv: 0 Reason: User Requested

Re: VPN 3005 Logging

sciarrino — Sun, 04 Feb 2007 20:09:52 GMT

Thanks, that worked.

Having Kiwi put it into a differnet txt file, then going to clean it up with excel.

thanks..

SCott