topic Re: Monitoring IPSec Remote Access Users in Network Security

Monitoring IPSec Remote Access Users

nagabhushana.k — Mon, 11 Mar 2019 14:15:19 GMT

Hi all,

please can any one help me to know about monitoring Remote access users using ASDM. As I have observed in ASDM, it is possible to monitor users currently logged in, but what I want to monitor is users who were logged in since the firewall started (for example, 30 days)..

Thank you,

Nagabhushan

Re: Monitoring IPSec Remote Access Users

srue — Wed, 19 Nov 2008 15:50:01 GMT

you really need to use your logs for that.

Re: Monitoring IPSec Remote Access Users

JORGE RODRIGUEZ — Wed, 19 Nov 2008 18:11:13 GMT

Nagabhushan, I do agree with Steven , you would need to use/implement logging.

it is possible to monitor users currently logged in

Yes you can

in ASDM goto

Home/Configuration/Monitor/VPN/Session

but what I want to monitor is users who were logged in since the firewall started (for example, 30 days)..

Since you don't have any permanent logging setup to send logs to a syslog server for that amount of time you have already lost that information from 30 days ago, you need to implement syslog .

Go over this link for monitoring, you can also filter syslog messages based on log ID number or logging severity levels

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/monitor.html

Re: Monitoring IPSec Remote Access Users

cpembleton — Thu, 20 Nov 2008 00:44:03 GMT

Syslog is the way to go. Just wanted to add something that will help on make syslog useful.

http://www.splunk.com

I use it for everything at home and work. There are free and enterprise versions.

Chad

Re: Monitoring IPSec Remote Access Users

nagabhushana.k — Thu, 20 Nov 2008 04:17:43 GMT

Thank you very much for your suggestion..

Nagabhushan