hi Harmeet,
if you have the ASA of any model you can use the following 2 methods to analyze the traffic that is passing from the ASA.
1- From- CLI
2- From -ASDM (ASA Device Manager)
3-capture traffic (only which is required)
before you move ahead, please note that firewalls usually dont have any storage space that can stored the traffic logs that is passing through it, until unless you have installed a Flash Card or USB.
1 - From CLI
from cli you execute many commands like the simple one is
- show logging: will display the running traffic
- show nat: will update you the translation information
- show xlate: will update you the static and dynamic table
- Show show conn, and show local-host conn
- show proc
- show asp drop
and so on the link below is the command reference guide in detail and will help you to get all the possible commands you want to execute.
2- ASDM:
from asdm it is quite easy and very informative to use. from asdm manager you can follow the following steps and can see the running traffic or live traffic or can filter the traffic as you require
login via asdm
after you login you will see that at the bottom of the asdm the logs are running which you can review, stop pause or start
click Monitoring from the top tab its option number 3
now on your right you will see all the ARP table learned by firewall
on left pane click logging
after you click logging, the right pane will change and you will have option to view
click view button
when you click view button, a new window will open and you will see all the logs that are currently being passed from firewall
you can use filter to search any specific information
you can create a filter to search
if you dont have any logging server then, you would require one to send your logs for proper storage and configure your security device on certain level
i hope this information will help you.
Cisco ASA 5500 Series Command Reference, 8.2 - same-security-traffic -- show asdm sessions [Cisco ASA 5500-X Series Fire…
