Question : Cisco PIX 506E logging for VPN connections using syslog

I have a Cisco PIX 506E firewall that I want to start logging.

From another thread, I was told a good way to do this is by using syslog messages with a syslog server software.
I have installed a trial version of winsyslog http://www.winsyslog.com/ and I need some help setting up.

What I'm trying to do is only log when who is connected to the VPN using their VPN client software.  Their account information and what date/time they connected and also what date/time they disconnected.

Is this possible?  If so, what are the command lines I need to make sure that's included into the Cisco PIX?  Is there a way in winsyslog to ONLY dump this information into a txt file?

Any help will be appreciated.
Thanks.

Answer : Cisco PIX 506E logging for VPN connections using syslog

Specific syslog entries when a vpn client logs in are not generated as standard syslog
These are all the messages that the PIX can log:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v53/syslog/pixemsgs.htm

Using that information, we can select specific messages pertaining to AAA authentication. Make sure the VPN clients use AAA even if is LOCAL for authentication

logging on
logg trap 5
logging host inside 192.168.111.111  <== ip address of syslog server
logging message 109005 level 5
logging message 109006 level 5
logging message 109007 level 5
logging message 109008 level 5
logging message 109009 level 5
logging message 109010 level 5

Then setup your syslog server to only display these message ID's

That's about as good as you're going to get in the way of logging VPN users
Random Solutions  
 
programming4us programming4us