topic Can you please explain some in Network Security

ASA log analyzer

Michal Valach — Tue, 12 Mar 2019 07:14:39 GMT

Hello, on ASA interface is "permit any any" rule, and I need to create ACL based on that log. Is anybody aware about any tool which can do it?

Many thanks for advice

Can you please explain some

Marvin Rhoads — Fri, 05 Feb 2016 15:46:27 GMT

Can you please explain some more?

Do you want to see all connections and flows transiting the firewall?

If so, you can just turn your system logging up to level 6 (informational). All TCP connections, UDP and ICMP flows will then create a syslog message that you can see either in the logging buffer, ASDM log screen or on any third party syslog server destination you have defined.

The log messages are just plain text records so you can parse and analyze them on your external syslog server using anything from simple text sorting, to *nix tools like grep and sed, to the capabilities of a commercial syslog analyzer like Kiwi syslog analyzer. You can also use the capability built into a fuill feature network management tool like Cisco Prime Infrastructure or Solarwinds NPM.

Hi,

Ji-Won Park — Sat, 06 Feb 2016 04:41:27 GMT

Hi,

There are a few tools available for your need, none of them is free though as this is one critical piece that lots of security admins want to address.

The one I've used is called AFA (AlgoSec Firewall Analyzer) featured called Intelligent Policy Tuning (there are FireMON, Tuffin as well) You have to connect this appliance to the FW and send specific logs to the appliance so that the appliance will give you more tighter rules and objects instead of any any.

Hope this helps.

Thanks

Hello Marvin,

Michal Valach — Sun, 07 Feb 2016 10:21:12 GMT

Hello Marvin,

We have 4 interfaces, were last ACL rule is " permit any any ( level 6)", and those logs are sent to some syslog. So yes what I did was usign grep/pipe and excel to create flow from the logs.

I was asking if there is any tool, but I believe there is not. Algosec/Tufin can do it as Ji Won mentioned it, but they are analysing flow online. But I have txt file and have to extract it.

Thank you