Is it possible to configure log-in/access logging (success & fail) locally on ASA?
If it's possible how?
If it's not then should I use asdm or TACACS?
-
Do you mean (admin) user login to the ASA?– Zac67 ♦Commented Dec 13, 2022 at 7:29
-
yes! logging for local user authentication success or failure.– Myung Seok KangCommented Dec 13, 2022 at 7:32
Add a comment
|
1 Answer
Cisco ASA can store logs locally but you will have much better results sending logs to an external syslog server.
It can also use external authentication like radius or tacacs+ but it can store events for local authentication if you want. Take a look at these log events for authentication and command logging:
https://community.cisco.com/t5/network-security/audit-log-on-cisco-asa-firewall/td-p/3710864
https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs1.html
Those should help you get started logging what you want but I would strongly recommend storing logs on a syslog server. Storing the logs in memory runs out quickly and you won't find what you want a lot of the time when you need to go back and look for it.
-
1thx a lot! I solved this from your help! I appreciate it! Commented Dec 20, 2022 at 7:56