All Apps and Add-ons

How to view Access Lists being utilized on Cisco ASA

kgangulw
Engager

Hello,

I have a new Splunk windows instance running. We have configured our Cisco ASA to send syslog data using UDP 514 and created a data input on Splunk listening on UDP 514.

The event type has been set to "cisco:asa"
Index is the default index.

Now we see data being collected on the index, so no problems there.

We installed the Add-on for Cisco ASA app with the hope it will help us see a graphical representation of the Access Control Policies being utilized by the ASA. Does anyone know if this can be achieved with this app? or do we need something else.

Thank you.

0 Karma

mmccul
SplunkTrust
SplunkTrust

If you make sure every access list has the log keyword, you can then analyze the 106100 log events generated and do charts based on the hexid in the log event. Those hexids are unique to the rule.

0 Karma

jimmy_ford
New Member

You will not see the ACL's but you will see the connections made or denied based on the ACL's. You must have logging down to the informational level as well.

Hope this answers your question.

Cheers!

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...