How to get MAC address information from CISCO anyconnect VPN logs?

[asadaliz123]

I need help in knowing If through "CISCO ANY CONNECT"  client MAC address information would be send in syslog payload. We are building a security monitoring use-case with a client, where we plan to whitelist MAC's and detect unauthorized access from Machines using MAC address from CISCO VPN logs generated by use of CISCO ANY connect. Could this be done?

[Farhan Mohamed]

You can get ip address for sure, Other than that please check the tshoot guide below, which might give you some help, Also let me know do you need help with MAC IDs of client connected in VPN logs.

[asadaliz123]

Thanks a lot Farhan, but I want to know If MAC address is part of syslog messages for CISCO ANY CONNECT? How can you help? and i don't see attach tshoot guide.

[Farhan Mohamed]

Please see the link below, I am still searching for that exact answer and i will get back shortly:-

http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/administration/guide/b_AnyConnect_Administrator_Guide_4-1/troubleshoot-anyconnect.pdf