I've been playing around with this and trying to figure out how to send a copy of the syslog, or a tail of the syslog. Use case:   When BGP events happen, I like to be notified.   I've got an EEM alert to email on syslogged BGP up/down neighbor events.   What I'd like to do is help my NOC and on call team by sending the syslog or a tail of the last 50 or so syslog entries so they can look at the events and know whether they need to address an issue or not.  I don't care if it's as an attachment or dumped into the body of the email. Any help would be appreciated. ... View more

What level of logging on the ASA will enable the syslog to see when a firewall rule has been changed?  I know debugging on the config level should be able to, but I don't want to put my firewall through that level of logging for everything. any help would be greatly appreciated! ... View more

I have a few switches that aren't able to use AAA/Radius authentication to log into the  HTTP/HTTPS management of my switches.   Others are able to The switches that work are on: 122-50.SE3 The switches that don't work are on:122-58.SE1 All switches can use AAA to login via telnet. AAA Code on the old switches: aaa new-model aaa group server radius RadiusServers server 10.150.1.13 auth-port 1812 acct-port 1813 server 10.150.1.12 auth-port 1812 acct-port 1813 aaa authentication login AuthGroup group RadiusServers local aaa authorization exec default group RadiusServers if-authenticated local aaa accounting connection AuthGroup start-stop group RadiusServers line vty 0 4 login authentication AuthGroup ip http server ip http authentication aaa login-authentication AuthGroup ip http authentication aaa exec-authorization AuthGroup AAA Code on the new switches: aaa new-model aaa group server radius RadiusServers server 10.150.1.13 auth-port 1812 acct-port 1813 server 10.150.1.12 auth-port 1812 acct-port 1813 aaa authentication login AuthGroup group RadiusServers local aaa authorization exec default group RadiusServers if-authenticated aaa accounting connection AuthGroup start-stop group RadiusServers line vty 0 4 login authentication AuthGroup ip http server ip http authentication aaa login-authentication AuthGroup ip http authentication aaa exec-authorization AuthGroup The  aaa authorization exec default group RadiusServers if-authenticated  command on the newer ios has the local option depricated from it. Struggling a little with this one.   Any help would be greatly appreciated. ... View more

We occasionally have a tunnel interface that flaps up and down on occasion, and a simple shut/no shut fixes the issue.   I saw that EEM scripts can perform actions based upon syslogged events, so we decided to give it a go.   I set up the following script, but when the tunnel goes down, it doesn't shut/no shut. event manager applet Tunnel5_Down event syslog pattern "Interface Tunnel5, changed state to down" action 1.0 cli command "enable" action 1.1 cli command "configure terminal" action 1.2 cli command "interface tu5" action 1.3 cli command "shut" action 1.4 cli command "no shut" I'm curious what I might be missing?    Also - is there anything to let me know that the router actually attempted to run the applet? ... View more

I am on version 8.2(1) of ASA Code. When accessing a SQL server on a secure internal interface,(Traffic is sourcing from DMZ) i'm getting some timeouts on the initial connection on port 1433.   All subsequent connections work fine.   Packet tracer shows the connection builds properly, and shouldn't have a connectivity issue.   The problem server is a webserver that connects back through the firewall to access the SQL server on port 1433.    We also have many other webservers in the DMZ which access the same SQL server, but do not have the same timeout issues.   Here are my timeouts, from the config timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 arp timeout 14400 I've seen a couple articles about increasing the tcp timeout to 3 hours for the DMZ interface, but I'm not sure that's the best idea. Does anyone have an idea what might be wrong?  ... View more

I had an interesting question posed to me today about how to limit bandwidth usage on the outside interface of an ASA device I did some research, and this is what I came up with.   Limiting traffic to 2.5 Meg a second class-map CM_BW_Throttle match any policy-map PM_BW_Throttle class CM_BW_Throttle police input 2500000 police output 2500000 exit exit service-policy PM_BW_Throttle Outside                    Will this interfere with the default inspections or other traffic?    I want to make sure it doesn't shut down traffic to the outside interface when it's applied. ... View more

Needing to bridge from my wic interface to an ethernet interface on a 2900 series router so that I can pass through the ip address given to the WIC, to my ASA so that I don't have to give my ASA a private range address. (Just like a service provider might do when bringing a T1 with managed router in to my prem) Any help would be most appreciated. ... View more