User logging

[alain.bider]

Hi all,

Is there any command where I can log users accessing PIX via telnet or pdm??

Regards,

Alain

[sachinraja]

Hi Alain,

how is the authentication done ? if it is local, then there isnt a way in pix to log the users. you cannot get any historical data. If you have a Cisco ACS, you can account for the users logging in the device.

However, you can see the present connections on the PIX by using the who command.

pixfirewall# who

0: From 192.168.1.3

1: From 192.168.2.2

hope this helps.. all the best.

Raj

[alain.bider]

Hi Raj,

Thanks for the quick response.

If I enable logging i get tons of messages. Is it possible to log specific messages?? like:

710001: TCP access requested from 192.168.0.117/1408 to inside:192.168.0.250/telnet

710002: TCP access permitted from 192.168.0.117/1408 to inside:192.168.0.250/telnet

This would more or less solve my problem (only having IP address of accessing device)

Regards

[shannong]

There are several other messages associated with user access and actions. 502103 would be useful way to track user login since you can't doing anything without being in enable mode.

502103: User priv level changed: Uname: shannon From: 1 To: 15

111008: User 'shannon' executed the 'enable' command.

111009: User 'shannon' executed cmd: show conn

Another advantage is that the first two are level 5 messages. If you turn on logging to level 5, you won't get level 6 and 7 messages.

There are 19 other level 5 messages. While you can't turn on just a single message, you could lower the logging level of this message to something like 3 and then only syslog at that level. Level 3 is errors and it would be good to capture others messages from this level and lower.

logging on

logging trap 3

logging host inside 1.1.1.1

logging message 502103 level 3

[alain.bider]

Thanks for your valuable input.

Is it also valide for login over pdm? I believe so, but not sure

Regards