PIX logg to syslog on hits

[pthomsett]

I want to make a PIX log to a sysylog server when a ACL rule has a hit. i.e. send a syslog to confirm that telent session rule has been allowed. At the moment it seems to send syslog for a deny but not a hit against a permit rule...? Any ideas..?

[Patrick Iseli]

Have you added the "log" statement in the access-list that you want to see in the syslog.

Second what is your logging level (warn, info, notif)?

access-list id [line line-num] {deny | permit}{protocol}{source_addr} {source_mask}{destination_addr}{destination_mask} [log [[disable | default] | [level]]] [interval secs]]

PIX>logging config example:

PIX>enable

PIX#conf term

PIX(conf)#logg on

PIX(conf)#logg trap wa

PIX(conf)#logg host inside 192.168.1.x.y

Access-list Command reference:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727a3.html#wp1067755

Logging Command reference:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727a9.html#wp1028090

sincerely

Patrick