topic ASA 5512 log function or something in Network Security

ASA 5512 log function or something

jet.chuk — Tue, 12 Mar 2019 09:46:03 GMT

We want to check what caused the server behind 5512 cannot be accessed from outside occationally.

If we can check some log like NAT traffic?

If we can set some monitoring?

Other way to do this?

Thanks in advance.

Aditya Ganjoo — Wed, 02 Aug 2017 04:01:39 GMT

Hi,

You can check the following things on the ASA:

show logging | in <server ip>--- Only if logging is enabled on the ASA

show conn | in <server ip>

show xlate | in <server ip>

Regards,

Aditya

Please rate helpful and mark correct answers

jet.chuk — Wed, 02 Aug 2017 04:22:52 GMT

Thanks Aditya,

How many (period) logging I can check if it is enalbed on ASA?

Will the logging be overwrite/cut if I go to check it not quickly enough?

Can I send log to a server to extend the period of logging if the answer of second question is yes?

Aditya Ganjoo — Wed, 02 Aug 2017 05:27:15 GMT

Hi,

Yes, you can send the syslogs to a server.

And it can be overwritten depending on the size of buffer set and the log level you set.

Use the following config:

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc6

https://supportforums.cisco.com/discussion/13028651/cisco-asa-syslog-forward-all-logs-syslog-server

Regards,

Aditya

Please rate helpful and mark correct answers