topic Re: Logging event for individual permit statement in Network Security

Logging event for individual permit statement

jamie.gleeson — Fri, 21 Feb 2020 17:36:26 GMT

I am trying to get a permit statement to log an event to a syslog server. Other events from the ASA are showing in the syslog server. I changed the logging level on the permit statement to Warnings but it did not help.

Permit statement:

access-list EOrg_access_in extended permit ip any any log warnings

Logging config:

ASA-15# sh run | i logging
logging enable
logging timestamp
logging standby
logging buffered notifications
logging trap informational
logging history informational
logging asdm notifications
logging host Default_VRF 1.1.1.1
no logging message 106015
no logging message 313001
no logging message 313008
no logging message 106023
no logging message 710003
no logging message 106100
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302018
no logging message 302017
no logging message 302016
no logging message 302021
no logging message 302020

ASA-15# sh logging
Syslog logging: enabled
Facility: 20
Timestamp logging: enabled
Hide Username logging: enabled
Standby logging: enabled
Debug-trace logging: disabled
Console logging: disabled
Monitor logging: disabled
Buffer logging: level notifications, 5137167 messages logged
Trap logging: level informational, facility 20, 6837647 messages logged
Logging to Default_VRF 1.1.1.1
Permit-hostdown logging: disabled
History logging: level informational, 6551457 messages logged
Device ID: disabled
Mail logging: disabled
ASDM logging: level notifications, 5137167 messages logged
configured rate is 10; Current average rate is 86 per second, max configured rate is 5; Cumulative total count is 51975

Re: Logging event for individual permit statement

Jaderson Pessoa — Fri, 18 Oct 2019 19:47:19 GMT

logging host Default_VRF 1.1.1.1: why vrf?

if you change just to loggin host 1.1.1.1, what happens?

Re: Logging event for individual permit statement

Marius Gunnerud — Sat, 19 Oct 2019 20:31:54 GMT

which event are you trying to log to the syslog server?

logging host Default_VRF 1.1.1.1: why vrf?

Default_VRF is the interface name where the logging server is reached by. If you just input logging host 1.1.1.1 you will get an error message.

Re: Logging event for individual permit statement

jamie.gleeson — Mon, 21 Oct 2019 14:23:04 GMT

We use the firewall between different VRF's. In this case the "Default_VRF" is the interface on the ASA to the VRF where the syslog server resides. The ASA is sending properly to the syslog server as I can see some messages. I just can't seem to get this permit rule to log when it is hit.

Re: Logging event for individual permit statement

jamie.gleeson — Mon, 21 Oct 2019 14:25:35 GMT

access-list EOrg_access_in extended permit ip any any

I am trying to log the above permit statement.