cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
671
Views
0
Helpful
2
Replies

CSMARS 6.0: a better VPN Tunnel Up / Alert

mdreelan
Level 1
Level 1

I've currently configured a rule to trigger on the keywords (from ASA's) "security negotiation complete" but I receive too many messages (smtp rule)from Lan-to-Lan sites generating this message.

2 Replies 2

8pcallahan
Level 1
Level 1

You might consider filtering out the LAN-to-LAN sites in the inspection rule. If you are using static IP addresses with your ISP you may filter further based on those.

Example - In the keyword section of the inspection rule:

Group NOT

(LAN-to-LAN OR

%ASA-3-713119: Group = x.x.x.x, IP = x.x.x.x, PHASE 1 COMPLETED)

It can take some real tweaking to get the desired result. Let me know if you need a more specific example of a rule. Hope this helps.