VPN Audit and Analysis

[tim_roper2]

Can the VPN concentrator line keep track of what users are accessing as well as log this information? If not, are there any solutions (Cisco preferred) that will report who, where, when and what users are accessing when they start a VPN session? Thanks, Tim

[gfullage]

The concentrator will send Radius Accounting records for when a user connects and disconnects, no problem.

Our SAFE documents (www.cisco.com/go/safe) advise that you plug the private interface of the concentrator into a DMZ of a firewall so you can not only restrict access to your network to the VPN clients, but the firewall can then provide logging of all connections opened by the VPN users. These logs should then be stored safely and kept for a period of time in case they're ever needed for litigation, etc.

[tim_roper2]

However, I still have the problem of searching back through multiple log files and correlating VPN user IP addresses with the username that was using the IP at that instant. Is there a way to merge the firewall logs with the VPN concentrator logs in order to generate one log that states what each user accesses?