I'm trying to use a searchable syslog server to track the flows on one of my ASAs but have run into a problem. Hypothetically, let's say I have a web server behind an ASA with IP address 192.168.1.1 and I allow access from anywhere to the web server. I know some but not all of the IP addresses accessing the server (eg clients in 10.1.1.0/24).
Question: If I put a specific access rule in permitting 10.1.1.0/24 to 192.168.1.1 with logging disabled followed by a less specific rule of any to 192.168.1.1 with logging enabled, should I expect to only see the events relating to the "unknown" traffic flows being logged? As I identify clients accessing my web server, I can add them to the first ACE to prevent logging.
I'm only interested in message 302014 (teardowns) so I can see whether they are FINs, resets or SYN timeouts etc, so the config looks like this:
What is SecureX?
Cisco SecureX is included with all Secure Endpoint (formerly AMP for Endpoints) subscriptions. SecureX is a cloud-native platform that aggregates capabilities across your security environment. It’s designed to simplify your environment, ...
Cisco ISE Secure Wired Access Prescriptive Deployment Guide
Authors: Hariprasad Holla (until June 2018), Mahesh Nagireddy (until Dec 2018)
For an offline or printed copy of this document, simply choose ⋮ Options > Printer ...
Meet the Authors Slides- SecureX and the Evolution of Security Orchestration Automation and Response
(Live event – Wednesday, 20th, 2021 at 10:00 a.m. Pacific / 1:00 p.m. Eastern / 6:00 p.m. Paris)
This event had place on Wednesday 20th, January 202...
The following guide goes over the in and out of the Cisco Endpoints Security Analytics Dashboard as an overview and faq page
For more information on the product offering, licensing, support, and how to solution (TAC) guide links and more please visit the...
Join us live on Tuesday, January 19 at 10:00 am PT (and on demand after) as we discuss the latest version of ATT&CK and the expansion of TTPs in v8.
As a security expert, you are tasked with protecting your environment. You see the value of...