Cisco Messages on Syslog

Discussion created by RSA Admin

on Sep 24, 2008
Latest reply on Sep 28, 2008 by RSA Admin

Like • Show 0 Likes0
Comment • 3

Hi, i am sorry if this question has been asked before, my question is that

We are running cisco PIX in fail over mode using Serial ports i would like to know what will be the exact messages whcih we should be putting in our Alerts i have checked the Cisco website and there are so many can you kindly tell me which one should i put only these 2 or any other as well

103001

103002

http://www.cisco.com/en/US/docs/security/pix/pix63/system/message/pixemsgs.html

Thanks

Outcomes

3 Replies

RSA Admin Sep 25, 2008 12:00 PM
As you indicated, there are potentially many events to look at, and it will vary from version to version and how you have your firewall configured.

You can certainly use the two you mentioned, but the PIX events in enVision that are more specifically tied to the actual switching between the firewalls are these:

104001
104001:01
104002
104002:01
104002:02
Like • Show 0 Likes0
Actions
- RSA Admin @ RSA Admin on Sep 25, 2008 4:40 PM
  Here is the XML for a correlation we use with Cisco ASA. BAsed on Matt's comments about the message code numbers this might work for you. We also added a filter that excludes events with the string 'config'. This will eliminate failovers initiated by a FW admin.
  Attachments
  - HealthMonitor-Device-CiscoASA.xml1.6 KB
  Like • Show 0 Likes0
  Actions
  - RSA Admin @ RSA Admin on Sep 28, 2008 8:53 PM
    Thanks all.., will implement and will let you know the progress
    Like • Show 0 Likes0
    Actions

Cisco Messages on Syslog

Outcomes

Attachments

Related Content

Recommended Content