08-27-2002 12:51 PM - edited 02-20-2020 10:13 PM
One of my customers asked me if there is a way for the PIX to report connection information about all inbound connection requests to his web server and e-mail server. He would like to log all inbound traffic requests. Is this possible?
08-27-2002 02:22 PM
You can use the 'show local-host' command to see real-time the active connections to a local host and the status of each connection. To log sessions, you require to setup syslogging (infomation level) and use a third party application to substract specific information from the syslog file.
09-06-2002 06:31 AM
Henry...I post this in another thread with a similar topic. Give this a try...
I was frustrated by this as well. While you can use "Informational" level logging you end up with a signal-to-noise ratio that is very poor.
My solution was to add an access-list statement on the edge router on the outside interface of the pix that looks something like...
access-list 105 permit tcp any host
This way the router allows the connection AND logs it like...
Sep 6 09:55:16
You only log the connections you care about and then you can set the PIX logging level back where it should be.
Hope this helps. It sure beats sorting through all those "informational" logs!
Pete
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide