Audit : Configuration Change on ASA

[manjeet_s1]

Hello Cisco Team,

How  we can check on the Cisco ASA that what changes has been done recently by someone?

[Kornelia Gutierrez]

It can be done if you have accounting enabled and exported to a server

[Karsten Iwen]

There are three typical ways to achieve that:

1. By sending the audit-data as log-messages to a syslog-server.
2. Using AAA-command accounting with a TACACS server like the Cisco ISE
3. Monitoring config-activity on the ASA which triggers a tool like RANCID that logs in to the ASA, loads the config and compares this new config with the last stored one.

[Tagir Temirgaliyev]

in addition to Karsten

you can make python or perl script which will load the config and compare this new config with the last stored one

this is usefull if you have hundreds of routers and firewalls, and you compare not only config but also for examle ios version