cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2584
Views
0
Helpful
1
Replies

Traffic Logs In ASA

Harmeet Singh
Level 1
Level 1

Hi,

It may be a repeated or very simple question.

How can I see and store the traffic (Live & Historical) details that is passing my ASA (IPs, Ports etc..)

Harmeet

1 Reply 1

Marvin Rhoads
Hall of Fame
Hall of Fame

You can see this via the syslog messages. TCP connections and UDP flows create level 6 (informational) log messages.

You enable logging for console, local buffer, ASDM or (remote) syslog servers. The first three types are limited to either the console session of a local buffer of limited size. If you send the messages to a remote server you are limited only by the amount of storage you have there.

Here's a sample configuration:

logging enable
logging timestamp
logging buffer-size 100000
logging asdm-buffer-size 512
logging buffered notifications
logging trap warnings
logging asdm notifications
logging device-id hostname
logging host inside <syslog server ip address>

In the above case I am sending only warning level messages to my syslog server (Kiwi syslog server in my case) as I don't want the thousands of informational level messages. I do this with "logging trap warnings" and the server is sitting downstream from the inside interface at the ip address specified.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/monitor_syslog.html

If all you need is a high level view of the connections, you can also export netflow data. Fro that you will need a netflow collector setup to receive them.

Review Cisco Networking for a $25 gift card