Hi,
I would suggest considering adding a "log" keyword to the "permit ip any any" rule you have and setting the logging level you want.
Here is the explanation of the "log" parameter at the end of "access-list" command
log | (Optional) Sets logging options when a ACE matches a packet for network access (an ACL applied with the access-group command). If you enter the log keyword without any arguments, you enable system log message 106100 at the default level (6) and for the default interval (300 seconds). If you do not enter the log keyword, then the default system log message 106023 is generated. |
I guess you might have to play around with the "interval" value perhaps.
Source from Command Reference:
http://www.cisco.com/en/US/docs/security/asa/command-reference/a1.html#wp1598407
To my understanding if you have a "permit" line in the ACL then usually no log messages are generated at all for traffic/connections matching these rules. The "deny" rules however generate Notifications level messages.
Since using the "log" parameter at the end of this "permit ip any any" rule will generate Syslog messages with a specific Syslog ID mentioned above, you could only have this "log" enabled on that single ACL and single rule of that ACL and log messages to a Syslog server.
You could then later gather the information and filter/parse the mentioned Syslog ID messages from that log. You could then further parse that log for the things that need to stay open and require their own rules.
Naturally there is probably tools that would also handle this but I havent had the change to work with any
I am wondering if any of the allowed traffic is outbound to Internet? I'd imagine this might cause problems to go through. Then again this kind of traffic could be allowed perhaps "permit tcp any any eq " to allow the basic services outbound.
Hope this helps
- Jouni
