Network Traffic Monitoring

[ray_stone]

Hi, I have setup all ASA FW on different locations and made Site to SIte Tunnel and Remote VPN and everything is working fine.As I know, the Accounting in AAA Server keeps the records of What users has done and Does Sys log Server contains of all information of every inbound and outbound packet of all interfaces of Cisco ASA. I have to monitor all traffic and how may I determine according to the Security concerned which Packet is a genuine one or which is not and If I may know about the attacks then which steps I must take. Thanks...

[Farrukh Haroon]

To really know about the attacks you would need a good IPS solution. The ASA (without the AIP-SSM) module is a device whose primary function is 'access control' and not attack detection and mitigation (even tough there is limited support for such configurations).

Regards

Farrukh

[ray_stone]

Thanks Farrukh, I really appreciate... Can you please suggest me any software through which I could monitor Interface Traffic? Does Sys log Server perform same work in Cisco ASA. Can you please send a link of documentation to know about IPS in better way. AIP-SSM stands for???? Thanks...

[Farrukh Haroon]

Are you looking for a free software or you need to purchase one? Nagios is one free one, there are many others.

Please have a look at these links:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6825/product_data_sheet0900aecd80404916_ps6120_Products_Data_Sheet.html

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/prod_brochure_list.html

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/prod_presentation_list.html

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_data_sheets_list.html

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/prod_brochure_list.html

Regards

Farrukh

[dhananjoy chowdhury]

Hi

If you are looking for monitoring of NW traffic from security point of view, you can try opensource sim tool like OSSIM.

If you want only to monitor NW devices/ Interfaces for Uptime/Availabilty/CPU/Mem usage etc.,then you can try OpenNMS or Nagios.

[merabtavart]

Check

http://www.vpnttg.com/

Advantage   of VPNTTG over other SNMP based monitoring software’s is  following:   Other (commonly used) software’s are working with static OID  numbers,   i.e. whenever tunnel disconnects and reconnects, it gets  assigned a  new  OID number. This means that the historical data, gathered  on the   connection, is lost each time. However, VPNTTG works with VPN  peer’s  IP  address and it stores for each VPN tunnel historical  monitoring  data  into the SQL server and into the RRD (Round Robin  Database) file.

HTH