How to get a report of VPN connections on a PIX

- D
- dbowman
  
  Contact options for registered users
posted
16 years ago

Wed, Jul 25, 2007 1:40 PM

My PIX 515E (running 6.5.4) is currently used to authenticate different VPN connections from users running Cisco VPN Clients. I would like to get a report of the users who connect to the PIX every day. My idea was to monitor the syslog and send an alert when a specific string appears in the log (using kiwi syslog alert function) I checked the syslog but I only found information regarding

ISAKMP session connected ISAKMP Phase 1 SA created sa created

with no info regarding the group used to connect. This is not useful

How can I get the correct information in the syslog so I can recognize which user connected?

Otherwise, have you a better idea to get this kind of daily report?

Thanks

Loading thread data ...

- A
- Al
  
  Contact options for registered users
Vote on answer
posted
16 years ago

Wed, Jul 25, 2007 7:57 PM

You're probably better off looking into the 'accounting' part of AAA, see:

formatting link

Should be quite easy to setup, we use FreeRADIUS running on Debian Linux to provide authentication/accounting for vpn clients. (Though they are terminated on an IOS router, not a PIX/ASA)

Hope that helps.

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.