topic Logging specific ports? in Network Security

Logging specific ports?

John Blakley — Mon, 11 Mar 2019 19:51:31 GMT

All,

I have a ton of entries getting logged to my syslog server, but the problem is that I need the particular message that's being logged.

firewall : TCP access denied by ACL from 10.x.x.128/1438 to INSIDE:10.x.x.x/80

I'm not seeing a way of doing this, but is there a way that I can log based off of an ACL? The hit up here is because we have very old systems that have a proxy server set up in their browsers. The old firewall that we replaced acted as a proxy server, but the ASA doesn't do that so we get these hits instead. Is there a way around logging these messages to the syslog server, but log all of the other hits in the same category? Does the 8.x IOS address this?

Thanks,

John

Re: Logging specific ports?

PAUL GILBERT ARIAS — Wed, 16 Feb 2011 15:37:37 GMT

you can log the hit on an ACL, for example:

ASA-1(config)# access-l TEST permit tcp any host 172.16.129.1 eq 80 log ?

configure mode commands/options:

<0-7> Enter syslog level (0 - 7)

Default Keyword for restoring default log behavior (log 106023)

alerts

critical

debugging

disable Disable log option on this ACL element, (no log at all)

emergencies

errors

inactive Keyword for disabling an ACL element

informational

interval Configure log interval, default value is 300 sec

notifications

time-range Keyword for attaching time-range option to this ACL element

warnings

ASA-1(config)# access-l TEST permit tcp any host 172.16.129.1 eq 80 log notifications

you will get a log message for each hit or you can set an interval. There you can see the options.

Then you should be able to disable the unwanted log messages.

Re: Logging specific ports?

John Blakley — Wed, 16 Feb 2011 18:30:58 GMT

Unfortunately, it's not working. I'm not even getting a hit on it on the ACL. I'm assuming that's because it's to the device and not through it.

What I've done is put the entry on line 3 on my acl that's on my inside interface:

access-list INSIDE line 3 permit tcp any host 10.125.100.54 eq www log disable

It's still logging to the syslog server.

Thanks,

John

Re: Logging specific ports?

PAUL GILBERT ARIAS — Thu, 17 Feb 2011 03:27:00 GMT

i don't think you will be able to stop the logs when going to your ASA and still allow the rest on the same category (same syslog ID) .