Cisco ASA - Logging from Access-Control Entries.

[kenth]

Hi,

I am logging directly to Splunk from several Cisco ASA's. I have set my ASA to log ACE entries on the notifications level and I send this level to syslog (Splunk). This should send all permitted and dropped logs to the Splunk. It seems like Splunk only recognizes the syslogs with dropped packets. How come? I have checked with normal syslog and I get both log entries.

For workaround I have to send syslog level information to splunk to be able to see permitted packets. This is not what I want because information sends the build and teardown of connections and it seems like thats how Splunk considers it's a "permitted" flow.

I am using the Splunk for Cisco Security. Anyone done this?

[kenth]

I've solved this in a new and packaged app that is available on Splunkbase as "Splunk for Cisco ASA".

[jgauthier]

Again,

This is an old post. But I have solved it and am happy.

Filter out the data from the host to only put in the data that the add on needs to process it's reports.

So, build a regex that captures the build lines, and the deny lines. Toss the rest!

[jgauthier]

Kenth,

This is an old post, but I am new to this add on. I'm having the same issue, and here's what I've discovered. The field extraction for the "firewall-accept" is keyed upon the words "Built", and "connection". This phrase is only available when 'logging informational' is on. This is an obscene amount of logging.

What would be ideal is if the field extraction used the words "access-list", and "permitted". Then logging level can be lower, and you can set up the ACL to include logging for those hits to the level you want.

I did this and it worked, but not all the way. The access-list log line is different than the built connection log line, and the rest of the fields are not extracted correctly.

I've been poking around and I cannot determine how to change this area. I could use some help on that. If anyone knows, that would be fantastic.