PIX status monitoring

jksnook · ‎05-17-2005

Does anyone know of a good way to review what traffic is going where within a PIX 501? I am specifically looking for a way to review the traffic that has gone inbound and outbound of our network in the last 8 hours.

Thanks,

Jason

jmia · ‎05-17-2005

Jason,

You can use pix syslog, you'll find a copy of it on the CD that came with your pix!

Hope this helps.

Jay

jksnook · ‎05-17-2005

Thank you, Can you tell me what level I should set syslog to? Also is there a way in the syslog server to only view allowed inbound/outbound traffic?

paddyxdoyle · ‎05-17-2005

If you haven't already got something in place to do this then it sounds like your only option is using the built in logging function on the PIX.

From the console the command is "show logging"

You can set up the logging function to log to an external syslog server if you have one or locally to the PIX, kiwi (http://www.kiwisyslog.com/) and 3cdaemon are freeware syslog servers that run on Windows

.

How to configure a PIX to sylog:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094030.shtml

Other than this, the PIX has an inbuilt packet sniffer which can be configured using the "capture" command:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727a6.html#wp1053548

Or if you have cisco routers on one or either side of your PIX you could configure Netflow which will allow you to view:

• Source and destination IP address

• Source and destination TCP/User Datagram Protocol (UDP) ports

• Type of service (ToS)

• Packet and byte counts

• Start and end timestamps

• Input and output interface numbers