I need help in knowing If through "CISCO ANY CONNECT" client MAC address information would be send in syslog payload. We are building a security monitoring use-case with a client, where we plan to whitelist MAC's and detect unauthorized access from Machines using MAC address from CISCO VPN logs generated by use of CISCO ANY connect. Could this be done?
You can get ip address for sure, Other than that please check the tshoot guide below, which might give you some help, Also let me know do you need help with MAC IDs of client connected in VPN logs.
