Re: Cisco PIX Logs - Rule Change
"saudi sans" <[email protected]>
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
Thanks Paul. We are not using AAA. However a change alert is good-to-start as we can cross-refer the change-request-forms Do you remember the Cisco message ID [ exact number or range]which captures these. I have been going through the link http://www.cisco.com/en/US/docs/security/pix/pix63/system/message/pixemapa.html#wp1003854 On 8/3/07, Paul Melson <[email protected]> wrote: > On 8/3/07, saudi sans <[email protected]> wrote: > > Does Cisco PIX 6.3 generate a log when a rule[ACL] is changed. > > Yes. The PIX records any time the configuration is changed. If you > are doing AAA for enable access it will record the username as well. > > > If yes does it contain which ACL was changed etc. > > Nope, sorry. > > > > We want to track all changes in rules via monitoring PIX logs? > > You'll need a 3rd-party tool. Kiwi CatTools might be worth looking at. > > PaulM >