I am running two ASA 5520 routers synched up with eachother. I had a massive connectivity issue this weekend that I am investigating. Now I have figured out how to get the live logging but I need to know how to get the old logs from my router.
View 4 RepliesWe’ve got lot of ASA appliances (around 30, 5505/5510/5520) and we never had this problem since the use of the new image software ASA 8.4(1) and ASDM 6.4(1). So, my problem is located on two ASA 5520 with active/passive failover with ASA image 8.4(1) and ASDM image 6.4(1).
My problem is that our appliance doesn’t show any logs when an ACL deny a packet, even if when I specify a specific “deny ACL” with a specific logging condition, asdm and ssh buffer logging are empty but the counters of the ACL increment.
Why my asa5520 brings out:
sh curpriv
Username : enable_15
Current privilege level : 15
Current Mode/s : P_PRIV
while i am logging in with my username which is XXXX. And in my ACS accounting logs I cannot see which user did what.
I have a problem on a Cisco ASA5520 version 8.2(5). A customer has set up a syslog to keep tracks of tcp sessions made by vpn users. On the syslog we filter %ASA-6-302013 and %ASA-6-302014 log messages, respectively: Built inbound TCP connection and Teardown TCP connection. When the connection is made by a vpn user, at the end of the log line you see the vpn username which should be the same in both the messages for the same connection. I have verified that when a user, let's say UserA, disconnects from the vpn, their tcp sessions are not properly closed; if another user, let's say UserB, establish a VPN immeditaely after and gets the same IP address previously assigned to UserA, the log sessions are recored with UserA in the %ASA-6-302013 message and UserB in the %ASA-6-302014 message. I presume this is due to the fact the tcp sessions are not tore down when the first user disconnects and it looks like a bug to me but I didn't find it referenced anywhere. Is there a way to have all tcp session tore down when a user disconnects the VPN connection?
View 2 Replies View RelatedI have a newish instance of 5520 running. I am seeing some odd logging issues in that the logs are significantly delayed showing up in the real time viewer. I'll try to connect, say on remote desktop, and will not see the traffic in the viewer for up to 20 seconds or so after I'm already connected to the server. I have not seen this before.
View 1 Replies View RelatedGot a classical remote access vpn with Cisco VPN Client and ASA-5520, Some weeks ago I noticed in my ASA logs this severity 5 Message. Group = xyz, Username = abc, IP = 84.n.n.n, Duplicate Phase 2 packet detected. No last packet to retransmit. This message comes with every connect, but then connections works fine.
Remark: See ASA ADSM:
- 1. Duplicated Phase II (!!)
- 2. Phase I
- 3. Phase II
I am using a 2851 router in mpls network. We had a power shut down activity recently and post to that i could not find any logs in the router.
View 4 Replies View RelatedI've noticed in the mornings lately when I get up around 6 am my internet will not work. Not on wireless or on my desktop. I decided I'd log into the router to see if there was a firmware update or anything. I had checked the logs and there are quite a few entries relating to DoS. I googled around and saw that it could be some sort of packet loss and the router is mistaking it for some sort of DoS attack. And that due to it not showing up multiple times every second it likely isn't a DoS attack. Here is a few from the logs:
[code].....
I'm getting below msgs in my ZBFW logs on my test router. .Apr 2 23:09:43: %FW-6-DROP_PKT: Dropping icmp session 115.186.192.153:0 10.40.2.100:0 on zone-pair ZP-OUTSIDE-INSIDE class class-default due to DROP action found in policy-map with ip ident 0
The bit I'm curious about is that I am NOT NAT-ting any ICMP. Hence why is the ZBFW even triggering against the LAN IP? It should only activate after NAT according to order of operations (and hence why unlike CBAC you put the inside local IP not the outside global IP).....
If the ICMP was directed at the WAN interface (not the 10.40.2.100 internal IP) then it is allowed, but morever even if blocked it should be logged against my WAN IP (which is publicly routable not a 10.x internal).
I have got a l2 link of 512 kbps from two different ISP. I want to aggegrate the bandwidth of this connection so that I can feel like having 1 mbps connection. I am not actually talking about load balancing, but bandwidth/link aggegration. Can we have the solution of failover with different vlan from different isp ? Can we be able to make the link as a single link.
View 2 Replies View RelatedIs LinkLogger the only option for reading logs on the WRT610Nv2? I read about Linksys's own software called LogViewer 1.14 but I can't find it.
View 3 Replies View RelatedI have hardware version 2 and firmware 3.0.2.01 (latest firmware available for this hardware version I believe) and I cannot get it to email me logs. I have entered my outlook address and our SMTP server.
View 1 Replies View Relatedif i flash my firmware on my router, can i still view the router logs before the flash? i heard that .logs can be on the ram of the router.
View 1 Replies View RelatedI have a D-Link model DIR-625, and it always seems to disconnect when my mother logs on her computer. Is there some kind of setting on her computer that could be disconnecting us? When my dad is on his I never disconnect which is why I am wondering it must be something on her computer that's interfering with the signal or something. If I reset the router while she's still on, It will disconnect again within a few minutes. So where can I check if it could be her computer that's interfering with the signal?
View 1 Replies View RelatedAs I've seen in my Linksys' admin panel, I have a log option (Administration/Log). So if I enabled it i can check which sites was browsed in my home network?And the second question: if Linksys can store the browsed sites history and if I will use a VPN connection on my PC or iPhone (not router!) the logs will be still look like before setting-up VPN on PC? So like: [URL] not like: [URL]?
View 3 Replies View RelatedHow i can transfer the router logs to email address.Wev are using the router 2600.
View 5 Replies View RelatedI have a cable modem internet connection and my cable modem is connected to an ASA 5505. The inside interface of the ASA has an IP address of 192.168.2.2 and is connected to a Linksys router's internet port which has an IP address of 192.168.2.1. The Linksys router then has a local area network of 192.168.1.0 and all my clients are on that network. Everything is working fine except in my ASA logs all the traffic shows up as the router's external address which is 192.168.2.1. I would like to see the 192.168.1.x address of the clients in the ASA firewall. I've tried making some changes to the Linksys router but that hasn't resolved it. Is there any changes I can make on the ASA to get this to work?
View 6 Replies View RelatedI have linksys E4500 and I would like to be able to see the website visited vs ip address.Is there a way to enable same or achive same via parental controls.Again I do not want to block a website but monitor which websites are visited. Is this achievable via router or an additional software/hardware required to be used with router
View 5 Replies View RelatedI absolutely need to collect the router logs and send them to a syslog daemon or via email.
View 9 Replies View Relatedhow to turn off this logs??
*Mar 2 13:26:07.919: %SEC-6-IPACCESSLOGP: list 101 denied udp 79.2.199.68(57143) -> x.x.x.x (34803), 1 packet
Router#
*Mar 2 13:26:09.766: %SEC-6-IPACCESSLOGP: list 101 denied tcp 108.15.116.235(63864) -> x.x.x.x (34803), 1 packet
Router#
*Mar 2 13:26:11.276: %SEC-6-IPACCESSLOGP: list 101 denied udp 24.130.2.212(26935) -> x.x.x.x (34803), 1 packet
I cannot read ACS 5.3 logs from my WCS. I have the ACS server added to the WCS. Below is the message I'm getting:
Unable to connect to any ACS View Server.Failed to access the WSDL at: { URL}. It failed with: {URL}. Do I need to install any special module on the ACS to support this?
I have a question about VPN Concentrator FTP Backup configuration to get logs on FTP server. I have configure FTP Backup with all details but I still do not see any logs on FTP server. Do you know what could be the issue? I have never used Concentrator and not sure what needs to be done to get in working condition. I am using VPN Concentrator 3015 series.
View 5 Replies View RelatedI have 3 ACS servers placed throughout N. America. I it set up so that ACS01 is primary and ACS02 and ACS03 are secondary. When i look at the logs for passed/failed authentications in radius or tacacs I cannot see anything from ACS03 logging. This is weird because just a few weeks ago it worked perfectly. In fact, ACS03 is the most active server since this site is using it for wireless phones and tacacs and the other 2 are just using ACS for wireless networking. I went through the log settings and every server is set up the same as the others (except the primary) so it should be logging ACS03 the exact same as 01 and 02.Anyway it seems like a small problem but i need the logs to work correctly to properly administrate security.
View 1 Replies View RelatedThere was a interface down in one of critical devices in the network.that particular log is not captured by the ciscoworks(DFM-alerts).
View 1 Replies View RelatedMy iphone started resetting the connection every 2 minutes today. I noticed that the date maximum is Dec 31, 2012. My logs are getting messed up, and NTP isn't setting. Is there a firmware update for REV E3?? I'm at 5.10 right now.
View 11 Replies View RelatedI want to secure our WLAN via Web Authentication with our new Cisco 2504 WLC. But where do i find user activity logs?
View 2 Replies View RelatedWe recently had to rebuild our ACS server. Now when we have an 802.1x authentication failure and look at the RADIUS logs for the specific user, it does not show us the MAC address of the device the user tried to login with. We use this all the time because users have PDAs and other mobile devices that they save their passwords on. Then when they change their domain password on their laptop, they don't change it on their PDA which then tries to authenticate them using the wrong password and eventually locks them out. We need to see the MAC address so we can pinpoint which device is causing the lockout. The report I am generating is when you go to this location: Monitoring & Reports > ... > Reports > Catalog > User > User_Authentication_Summary
View 4 Replies View RelatedI have hardware version 2 and firmware 3.0.2.01 (latest firmware available for this hardware version I believe) and I cannot get it to email me logs. I have entered my outlook address and our SMTP server.The log says that it's failing each time it attempts. I have scoured the internet and I cannot find a solution that will work for me. I have found some talk of adjusting an MTU setting which is supposed to be located under the firewall / general tab.
View 1 Replies View RelatedI have turned on 'Local log' and 'output blocking event log' on my WRVS4400N v2 with latest fw.When I am clicking 'view log' button I can't see anything in empty fields. When I am trying to change logs genre I have empty fields all time.
View 1 Replies View RelatedI am trying to setup logging on my router. I want to use my gmail account / gmail SMTP server to send emails.
Does the router support TLS for SMTP?
Oh - and I also get the "critical error" page. I get it when I try to un-check the send logs checkbox in the remote logging management page.
I have a 5508 wireless lan controller we have two SSID configured Profile Name : Corporate and Guest When I go look at the Most Recent Traps all I see is Client with Mac address blah has joined your corporate, this goes on for sometime. But I am unable to see any of the Guest logs joining the network, I have since then grabbed my laptop and connected to the guest log. I still dont see any logs in Most Recent Traps for the Guest SSID WLAN configuration, I then blocked my Mac address and tried to connect again, No logs. I need to also montior the guest network is there some special tick box I need to apply for this to work? Once the guest is connected I can view them in the clients list but it never shows them on MOST RECENT TRAPS but I want to see the guests account connecting or failing to connect as we currently have a rogue device annoying me.
View 3 Replies View Relatedwhat is the meaning of the following log messages on Cisco 7604 Core routers. The Core router is configured with 2 STM card configurations with Vlan assignments: [code]
View 3 Replies View RelatedWe are using almost 10 Nexus 5k in our DC currently we are getting same error logs in all Nexus 5k." ntpd[4746]: ntp:time reset +0.279670 s " ,Is it major error or just for reset time?
View 1 Replies View Related