Cisco ASA peeps - IPSec RAS VPN's, Need to obtain logs on user sessions

DJMK4

DJMK4

DJMK4

Soldato
Joined
1 Dec 2004
Posts
23,140
Location
S.Wales
Hi all,

Just a quick question, I need to obtain a log of the user sessions that are logging in over IPSec RAS VPN, sometimes (on the newer firewalls) I have been able to go in over CLI and do a show log which would generate, you can see attempts including username, session time etc along with orinating IP.

They have RADIUS servers configured, I have someone looking to see if they can grip logs of the RADIUS server, but at the moment prooving not fruitful.

This appears to be an older firewall so the show log is not really generating what I need, is there another easy command to use to just simply show the IPSec RAS VPN attempts?

I am just looking through the show isakmp commands to see if this is what I need.
 
I have found the command "show ipsec sa" which will give a basic list of active sessions.

However I dont seem to be able to output "historical" logs.
 
If you can setup a syslog server, you can send the output of IPSEC sessions(logins, etc) to the syslog. Or if using RADIUS you can send that output to syslog. Might not be able to configure that granularity on ASA, but on any good syslog server you can ignore output your not interested in. I use kiwi syslog server, I think you can get a free download or trial
 
Yeah I was grepping off the syslog server earlier, bit of pain though the info they want is not there, some is, mainly for active connections, but then you have to grep by day
 
You must log in or register to reply here.
Back
Top Bottom