topic FTD RA VPN Logs in Network Security

FTD RA VPN Logs

alex.f. — Sun, 07 Apr 2024 08:57:31 GMT

Hi,

I try to find some Information of Remote Access or Mail ingress/egress activities on an FTD 3110 Tech support file or the Device it self.

I don't have any access to the FMC.

Re: FTD RA VPN Logs

MHM Cisco World — Mon, 08 Apr 2024 07:31:10 GMT

you want FTD always debug the connect from Anyconnect ?
MHM

Re: FTD RA VPN Logs

alex.f. — Mon, 08 Apr 2024 12:45:34 GMT

hi,
my question is whether there is a possibility to extract connection information from the TechSupport file of an FTD afterwards, which provides information about malicious network activities to a device in the local network.

For example, I am looking for successful RA VPN dial-ins by users or access to certain ports.

Re: FTD RA VPN Logs

Marvin Rhoads — Mon, 08 Apr 2024 12:55:12 GMT

Most historical logs (including the type you are asking about) are streamed to the managing FMC in near real time and then deleted on the local device.

Re: FTD RA VPN Logs

alex.f. — Tue, 09 Apr 2024 13:11:02 GMT

Thanks for the feedback, unfortunately I already suspected this.

We are currently trying to restore the FMC data.
But this may take a few more weeks.

Re: FTD RA VPN Logs

MHM Cisco World — Tue, 09 Apr 2024 13:27:47 GMT

Did you check

Show vpn sessiondb anyconnect detail

This can access from cli of ftd' it give you breif which user connect to your FTD know

MHM

Re: FTD RA VPN Logs

Marvin Rhoads — Tue, 09 Apr 2024 15:06:33 GMT

The command "Show vpn sessiondb anyconnect detail" will only show current connections with details (such as username, user IP real address, assigned VPN address, connection profile, tunnel-group, duration etc.).

It will not show details of any previous sessions.

Re: FTD RA VPN Logs

MHM Cisco World — Thu, 11 Apr 2024 06:20:48 GMT

Thanks, but even FMC don't keep this info for long time (without external syslog).

If user access via ssl vpn to ftd and it idle timeout is not end he can see it details via show vpn sessiondb.

MHM