Cisco
Overview
The Cisco ASA is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities. It provides proactive threat defense that stops attacks before they spread through the network. Therefore, the Cisco ASA firewall is the whole package, so to speak.
- From the CISCO ASA machine to an internal log concentrator (Rsyslog), then forwarded to SEKOIA.IO
Event Categories
The following table lists the data source offered by this integration.
Data Source | Description |
---|---|
Host network interface |
every packets are logged and information on the outcome, the source/destination are extracted |
Network device logs |
ACL logs are examined in detail |
Network protocol analysis |
ICMP, TCP and UDP packets are fully analyzed |
Configure
CISCO ASA logs
On CISCO appliances, most of the important hardward and software activities that are relevant for security detection and analysis, are enable by one simple command. To enable logging, enter the following commands:
hostname(config)# logging enable
hostname(config)# logging timestamp
hostname(config)# logging trap informational
Transport to the concentrator
Prerequisites
The following prerequisites are needed in order to setup efficient log concentration:
- Have administrator privileges on the CISCO ASA
- Traffic towards the Rsyslog must be open on
UDP 514
Configure the CISCO ASA
In ordre to forward the logs to a Rsyslog, please follow those commands:
Note the interface name
hostname(config)# show interface
Note the host name
hostname(config)# show hostname
You then have to configure an output destination for logs. Here, we choose to send syslog messages to an external syslog server.
hostname(config)# logging host interface_name syslog_ip [ tcp[/ port ] udp [/ port ]
Example:
hostname(config)# logging host interface_1 127.0.0.1 udp
Explanations:
- The
interface_name
argument specifies the interface through which you access the syslog server. - The
syslog_ip
argument specifies the IP address of the syslog server. - The tcp[/ port ] or udp[/ port ] keyword and argument pair specify that the ASA and ASASM should use TCP or UDP to send syslog messages to the syslog server.
- You can configure the ASA to send data to a syslog server using either UDP or TCP, but not both. The default protocol is UDP if you do not specify a protocol.
If you specify TCP, the ASA discovers when the syslog server fails and as a security protection, new connections through the ASA are blocked. If you specify UDP, the ASA continues to allow new connections whether or not the syslog server is operational. Valid port values for either protocol are 1025 through 65535. The default UDP port is 514. The default TCP port is 1470. For more information about Cisco ASA logging, please refer to your Cisco documentation.
Transport to SEKOIA.IO
Rsyslog
The reader is invited to consult the Rsyslog Transport documentation to forward these logs to SEKOIA.IO.