LMS 4.0.1, Understanding Change Audit Report.

[andrea.meconi]

Hello.

I need to understand why change audit report reports an unused username

From help...

Name of the user who performed the change. This is the name  entered when the user logged in. It can be the name under which the LMS  application is running, or the name using which the change was performed on the  device.

The User Name field may not always reflect the user name. The  User Name is reflected only when:

• A config change was performed using LMS.

• A config change was performed outside of LMS, but the  network has username-based AAA security model, wherein authentication is  performed by an AAA server, which could be TACACS/RADIUS or local.

Regards.

Andrea

[Michel Hegeraat]

If you filter on configuration changes then it would appear that the changes are made using a local user or on the console

Did you analyse what the changes are?

Changes detected on for example "ntp clock period" are not done by anyone. There are not really changes.

Cheers,

Michel

[andrea.meconi]

Hello Michel and many thanks for your help.

There are many changes: ACLs and so on...

LMS reports a change made overtime by an user without privileges to login to firewall console!

Regards.

Andrea