Be alerted when a ASA rule is activated?

Andy White · ‎06-18-2010

Hello,

Can I be alerted when a rule is used on my ASA 5520? I do have a syslog server, but don't know how to getthis alert in there or if it's the best way?

Thanks

Jennifer Halim · ‎06-18-2010

If you have the "log" keyword at the end of your access-list, it will be logged as a syslog message. It's syslog message# 106100:

You can send those syslog messages to a syslog server.

Example:

logging enable

logging list acl-list message 106100-106100

logging trap acl-list

logging host

Hope that helps.

David White · ‎06-18-2010

Additionally, you can send that specific syslog out as an e-mail from the ASA. It just depends what you are looking for.

Let us know if this answers your question, or if you have a follow-up.

Sincerely,

David.