Can someone gave some hints on how to enable logging on IPSec tunnel on ASA ? I have typical scenario S2S IPSec and i like to monitor when it goes down and other information. But can't find a way to do this.
-
Do you have a syslog server or are you looking for emails direct from the ASA for notification?– some_guy_long_goneCommented Aug 18, 2014 at 11:50
-
For now i have setup Notifications and information on a buffer to be send on an FTP server ... I don't have syslog server or configure for e-mail ...– user3523605Commented Aug 18, 2014 at 13:29
Add a comment
|
1 Answer
General Logging
To log IPSec events, you will want to run the following commands:
logging enable
logging emblem ! (optional for Cisco's emblem format)
logging timestamp
logging buffered notifications
Some of these commands will already be on your ASA as you're sending your buffered log to an FTP server. I won't include the FTP commands due to this. Then you will want to look for the specific codes you're interested in, in the log on the FTP server.
Example IPSec L2L disconnect message:
%ASA-4-113019: Group = 202.XXX.YYY.ZZZ, Username = 202.XXX.YYY.ZZZ, IP = 202.XXX.YYY.ZZZ, Session disconnected. Session Type: LAN-to-LAN, Duration: 1d 1h:13m:46s, Bytes xmt: 372142455, Bytes rcv: 384146009, Reason: Lost Service
Emailed Notifications
First create your list of events you want to catch.
Catch All IPSec List
logging list IPSec_Notifications level notification class vpn
Specific Event List
logging list IPSec_Notifications message 113019
! Replace XXXXXX with next code
logging list IPSec_Notifications message XXXXXX
! Repeat for the rest of the codes you're interested in
Now setup the email settings.
logging mail IPSec_Notifications
logging from-address [email protected]
logging recipient-address [email protected] level notifications
smtp-server X.X.X.X ! Replace with your SMTP server IP
Notes
All of the logging above is limited to notifications and higher level (i.e. level 5, 4, 3, 2 and 1). If you find a code of a lower level, you will need to replace level notifications with level informational or level debugging.
The example event above (ASA-4-113019) is level warnings which you can see from the ASA-4 prefix on the event.
answered Aug 18, 2014 at 14:11
-
Hey thanks for this man ill already configuring ... and iv note some very difficult to explain, i'll open a new post because i can't find way my tunnel is going down. Once again thanks for this hints/reply ! Commented Aug 18, 2014 at 16:49
-
One thing I've had issues with on an ASA IPSec tunnel vs an IOS IPSec tunnel is the ASA will drop the tunnel if it receives any traffic not including in its SA ACL whereas the IOS IPSec tunnel will just ignore that traffic but not drop the tunnel. Make sure the ACL for traffic is identical on both sides of the tunnel. Commented Aug 18, 2014 at 16:50
-
Im using ASA with Openswan and the tunnels knows to go down for unknown reasons ... This is the new question that i ask ...link Commented Aug 18, 2014 at 18:00