topic Audit log on cisco ASA firewall. in Network Security

Audit log on cisco ASA firewall.

_Ratha_ — Fri, 21 Feb 2020 16:15:57 GMT

There are several users with administrator role on network devices. sometime configuration change without acknowledgement. I want to know who have been log in and what they have made change.

How to monitor this activity on cisco ASA, switch or router?

Re: Audit log on cisco ASA firewall.

balaji.bandi — Fri, 21 Sep 2018 07:30:42 GMT

How is your user authentication setup done, you have ACS or any other mechanism in place for authentication and authorization ?

Re: Audit log on cisco ASA firewall.

Marvin Rhoads — Fri, 21 Sep 2018 09:31:36 GMT

As @balaji.bandi alluded, an Accounting server (the third "A" in AAA) is the answer. An external RADIUS or TACACS+ server (like Cisco ISE) can keep a log of all actions.

You can also set the ASA to log all login and command execution actions and send those logs to an external syslog server.

logging enable
logging list cmds message 111009

logging trap cmds

logging host inside x.x.x.x

You can replace 'inside' with the name of interface where syslog server x.x.x.x resides.

Re: Audit log on cisco ASA firewall.

NeWGuy1109 — Mon, 30 Sep 2019 13:29:19 GMT

Hello,
if Informational Logs are being forwarded to an external syslog.. then will message ids 111008-111010 will get auto logged to syslog ?

Re: Audit log on cisco ASA firewall.

Marvin Rhoads — Mon, 30 Sep 2019 14:16:17 GMT

111008 and 111010 are notification (level 5), so yes for those.

111009 is debug (level 7), so no for that one.

(Unless you override the default severity level)

https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs1.html#con_8587071

Re: Audit log on cisco ASA firewall.

NeWGuy1109 — Tue, 01 Oct 2019 10:10:33 GMT

Thanks for the reply..
i am using algosec firewall analyzer and all syslogs from firewalls are being forwarded to it .. i can see the configuration modification (under raw configuration) but the user id is not available .. is there any way the commands being run from a session in ASA can be sent as audit log information ? does asa record user id in raw configuration ? the hide username setting is also disabled.

Re: Audit log on cisco ASA firewall.

MSJ1 — Fri, 19 Mar 2021 10:02:41 GMT

Hello Marvin,

Based on my below logging config , should this send TRAP for Event ID 111008 to my Event Server ( Cisco Security Manager ) ?

Also can you share the Doc where Event ID's are mapped according to Severity

logging enable
logging buffer-size 10000
logging buffered debugging

logging trap debugging
logging asdm informational

logging facility 22

logging host inside CSM_IP

logging message 305011 level debugging
logging message 302015 level debugging
logging message 302016 level debugging

Re: Audit log on cisco ASA firewall.

MSJ1 — Wed, 24 Mar 2021 19:52:27 GMT

Can you share the Doc where Event ID's are mapped according to Severity

Re: Audit log on cisco ASA firewall.

balaji.bandi — Wed, 24 Mar 2021 20:37:49 GMT

below document has this information :

https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/messages-listed-by-severity-level.html