CSMARS 6.0: a better VPN Tunnel Up / Alert

[mdreelan]

I've currently configured a rule to trigger on the keywords (from ASA's) "security negotiation complete" but I receive too many messages (smtp rule)from Lan-to-Lan sites generating this message.

[8pcallahan]

You might consider filtering out the LAN-to-LAN sites in the inspection rule. If you are using static IP addresses with your ISP you may filter further based on those.

Example - In the keyword section of the inspection rule:

Group NOT

(LAN-to-LAN OR

%ASA-3-713119: Group = x.x.x.x, IP = x.x.x.x, PHASE 1 COMPLETED)

It can take some real tweaking to get the desired result. Let me know if you need a more specific example of a rule. Hope this helps.

[mdreelan]

good idea...im learning to think a bit more like CSMARS....using "!=" solves more than one isse.