PIX reporting user Activity

[polaruser]

Could you suggest tools to create reports on users activity thru PIX . We use Websence software, but it shows destination only, without traffic, protocol?

Thanks

[nsteup]

Use a Tacacs Server and enable aaa accounting for your needed reports. You can get accounting reports based on inbound and outbound IP addresses. If you want to get reports based on usernames, you must also authenticate the users against your tacacs server.

Regards Norbert

[gsatchivi]

A simple solution to collect info on all traffic that traverse the PIX is to configure the pix to dump its log into a syslog server. We use syslog on a solaris server and set the debug level to 7 on the PIX. Expect a lot of data though. If you use Windows, I am sure you can find syslog for windows. You get verything: source ip/port destination ip/port and where applicable, full URL info. And it is all timestamped, of course.

Good luck.

gilles