topic ASA 5520 - Security Audit in Network Security

ASA 5520 - Security Audit

gregorysieg — Tue, 12 Mar 2019 03:05:05 GMT

Hello,

I would like to pull a report for the last 24 hours of all external connection attempts to our ASA. I went into Monitoring via the ASMD (7.1) and changed the logging level to "Informational" however I do not see anything coming in it only seems to be showing my internal going out. Could someone please supply me with some information or direction on where I could find documents for this.

Thanks,

Greg

ASA 5520 - Security Audit

jumora — Thu, 14 Nov 2013 21:18:15 GMT

The ASA has a logging buffer that by default is short, it is expected that if you are monitoring traffic to or through the ASA you configure a Syslog server since past events are not saved into disk unless specified.

ASA 5520 - Security Audit

Julio Carvajal — Thu, 14 Nov 2013 22:26:35 GMT

Hello Gregory

My recommendation for this is to leverage the UDP Syslog packets to a External device so you can save memory on the ASA for different traffic.

Note: You should consider Netflow as it will provide you granularity and also depending on the vendor software they will build reports, etc on their own with the data send to the collector.

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

ASA 5520 - Security Audit

gregorysieg — Mon, 18 Nov 2013 16:06:42 GMT

Thanks guys,

I actually did setup a syslog server thinking that was going to be the ticket but wasn't 100% sure. I will take a look at Netflow options down the road.

ASA 5520 - Security Audit

gregorysieg — Fri, 22 Nov 2013 17:47:23 GMT

Guys,

I have a Syslog up and running but am finding I'm not really getting the information I was expecting. I was thinking I would see numerous denied attempts to say port 3389, 23, or other well known ports but really I'm pretty much just seeing alot of "Teardown connections", "Built connections", "Access List permitted", and some randle "Deny TCP (no connection). Now I think the Deny TCP (no connection) may be what I'm looking for but I really expected to see quite a bit more of this type of traffic? I figured I'd pick up some port scanning attempts or something maybe it's there and I just am not viewing it correctly or maybe I'm looking in the wrong place? Maybe I'm just expecting more negative then I should be. Any thoughts?

Thanks,

Greg

ASA 5520 - Security Audit

Julio Carvajal — Fri, 22 Nov 2013 18:38:01 GMT

Hello Greg,

So you are not seeing any Deny ACL???

Look for log ID 106023

106023

106023 p

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com