Need some clarification about 113015

[csathya41]

In cisco document, I found this log is for failed IPSec/WebVPN.

<166>Jun 2 2011 13:04:23: %ASA-6-113015: AAA user authentication Rejected : reason = Invalid password : local database : user = asauser

But if I tried to telnet my firewall with wrong credentials, I am receiving this log.

This log is for both VPN and admin failed login?

How can I differentiate which one is failed vpn log and which one is admin related log?

Please some one help.

Thanks

Sathya

[andamani]

Hi,

the error message states "AAA user authentication Rejected : reason = Invalid password : local  database : user = asauser"

This should apply to any invalid password. i.e. vpn as well as admin.

I am quite sure why the syslog message decoder states that it is for vpn users.

I don't think you can distinguish this from the syslog message number. checking the failed attempts of AAA server would be a better option i guess.

Hope this helps.

Regards,

Anisha

P.S.: please mark this post as answered if you feel your query is resolved. Do rate helpful posts.