How to generate syslog for VPN user connection - Cisco router IPsec Ikev1

[Deepak Kumar]

Hi, 

My client wants to keep records as of when and who was started the VPN from remote to the office. He is using Cisco 2901 router with "155-3.M5" IOS. 

Actually, he wants to see  "who and when" was login by VPN from the remote. He is using local aaa accounts for VPN login. 

Currently, he can see the Virtual interface was come up and went down. 

03-15-2018 16:24:34 Local7.Notice 10.10.XX.1 619144: 620122: Mar 15 2018 16:24:33.492: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access3, changed state to up
03-15-2018 16:24:34 Local7.Notice 10.10.XX.1 619143: 620121: Mar 15 2018 16:24:33.416: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access3, changed state to down

Please suggest a solution.  

Regards,

Deepak Kumar

[Rob Ingram]

Hi,
I use an IOS Router with FlexVPN (IKEv2) and authenticate using Certificates, to get user login information the command I use is "crypto logging session ". I believe this will work on IKEv1 also.

The output from this is:
"%CRYPTO-5-IKEV2_SESSION_STATUS: Crypto tunnel v2 is UP. Peer 1.1.1.1:53526 Id: cn=Username,cn=Users,dc=lab,dc=local"

[Deepak Kumar]

Hi, 

Thanks for your reply. This command help me to know "IP address" of user and ID

%CRYPTO-5-SESSION_STATUS: Crypto tunnel is UP . Peer XX.XX.XX.XX:38551 Id: XXX-XX <Group Name>

But I am looking username along with above details. 

Regards,

Deepak Kumar

[Rob Ingram]

Are you using EZVPN?

[Deepak Kumar · Accepted solution]

Hi, 

thanks for your reply. We got the solution. actually, it is ezvpn and I enabled the logging with command

"Crypto logging ezvpn"

Regards,

Deepak Kumar 

[Rob Ingram]

Thought so. Glad to hear it's working

More related info for EZVPN syslogging which maybe useful:

https://www.cisco.com/c/en/us/products/collateral/security/ios-easy-vpn/prod_white_paper0900aecd803fc77b.html