topic Re: Log every connection to ASA and router in Network Security

Log every connection to ASA and router

ccnpwannabe — Fri, 21 Feb 2020 12:11:30 GMT

I have a Cisco ASA 5520 and a Cisco 3825 router in my network. I want to log every connection made to these devices. There are a few users who have different levels of access to these n/w devices. I want to log all these users and what they actually change and implement in the devices. Is this possible using a TACACS server or any other method pls. I also have read/ write access to these devices. Many thanks

Re: Log every connection to ASA and router

Panos Kampanakis — Wed, 15 Dec 2010 22:26:49 GMT

You can log every "Built connection" syslog on the ASA.

On the router you can log an ACL line that says "permit tcp any any syn log".

So you will be looking into your syslogs server for these syslogs.

I hope it helps.

Re: Log every connection to ASA and router

ccnpwannabe — Thu, 16 Dec 2010 12:56:49 GMT

Hi how abt installing a TACACS server. any suggestions

Re: Log every connection to ASA and router

Panos Kampanakis — Thu, 16 Dec 2010 14:08:19 GMT

You can do that also.

You can use auth-proxy (router) cut-through proxy (ASA) to have the user authenticate for connections that he is making and do ACS accounting. But I don't think you need to do that for all connections, only for the ones that require user interaction.

Let us know if that answers the question.