VPN Connection Log Activity

[dipak jaiswal]

Hello,

We have configured client to site vpn at one of our client site and it's running properly, but we are unable to monitor the vpn connection log. We have configured syslog server for the same. The user are authenticating from the local database of ASA. We have configured the following thing at ASA for VPN connection logging:

ASA#

logging enable

logging timestamp

logging standby

logging console informational

logging monitor informational

logging trap informational

logging history informational

logging asdm informational

logging facility 23

logging host INSIDE 172.21.15.10(Syslog server IP)

The asdm and syslog server are not capturing the log of VPN Connectin. The client want the following log information of VPN Connection.

1. VPN login and exit time.

2. VPN login username and password

3. If possible, what they have done after logging.

Please help me to solve this issue.

Thanks a lot for your support.

Regards

Dipak

[Anu M Chacko · Accepted solution]

Hi Dipak,

Enable the following:

logging class vpn buffered debugging //to log to the buffer
logging class vpn trap debugging //to log to a syslog server
logging class vpnc buffered debugging //logging for vpn client activities



Hope this helps!

Regards,
Anu

P.S. Please mark this question as resolved if it has been answered. Do rate 
helpful posts.

[dipak jaiswal]

Hi,

Thanks a lot for your support. It's working now. I have some query which are mentioned below :

1. It's showing only the login time, but not the logout time.

2. If client is doing any activities, it's not showing at syslog server.

3. Suppose a client connect or logout via vpn, at the same time mail will be generated by ASA  to the concerned mail id that from this ip with user id and time mentioned in the maid id, has logged in or logged out. Is it possibe ?

Thanks a lot in advance.

Regards

Dipak

[mvsheik123]

Hello,

Try if this helps.. When you enable 'logging buffered debugging'  - you can see all the logs with message ID#. Select the messages you want to get emails for and add the logging list...

logging list ASA_CRITICAL message <#> : Single message id

logging list ASA_CRITICAL message <# - #> Range of messages

logging trap ASA_CRITICAL

logging from-address ASA@companyname.com

logging recipient-address name@comapnyname.com

smtp-server

With the config I use on my ASA, I receive emails for any commands run on ASA and when the user (not the VPN user,

but the ASA logged in admin) logged out etc.

hth

MS