• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 379
  • Last Modified:

username in pix traffic log

Dear Experts,

Consider the following logs from PIX

<166>May 23 2006 21:11:17: %PIX-6-302015: Built inbound UDP connection 12591 for outside:xxxx/1025 (xxxx/53) to inside:xxxx/53 (xxxx/53) (john)
<166>May 23 2006 21:11:17: %PIX-6-302016: Teardown UDP connection 12591 for outside:xxxx/1025 to inside:xxxx/53 duration 0:00:01 bytes 612 (john)

Above logs are part of some udp traffic. For some logs I am getting username here and for others I am not. John is the user who is connecting my network through VPN.  Now my question is in what conditions username will appear? Will I always get the username If the traffic is going thrugh VPN?

with regards,
Kumar

0
mskumar_apk
Asked:
mskumar_apk
  • 3
  • 2
1 Solution
 
rsivanandanCommented:
Any connection authenticated through AAA will get username as per Cisco Documents. So your VPN user is getting authenticated through AAA mechanism and so the answer is YES.

Cheers,
Rajesh
0
 
mskumar_apkAuthor Commented:
Sorry for the late reply was out of office for a while. That is great answer. I verified that.

Like wise is there a way to find the amount of traffic that is going through VPN per user? What is the signature in the log that I can look for?

regards
Kumar
0
 
rsivanandanCommented:
Hmm. that is a big question by itself and right on the top of my head I don't feel anything.

Can you open up another thread ?

Cheers,
Rajesh
0
 
rsivanandanCommented:
Post the link to the other question here ? I'm not sure if you can do that for individual vpn connections but there are more experienced guys here and I'd like to watch.

Cheers,
Rajesh
0
 
mskumar_apkAuthor Commented:
Hi,

Here is the question.

http://www.experts-exchange.com/Security/Firewalls/Q_21906797.html

I'm not sure if you can do that for individual vpn connections but there are more experienced guys here and I'd like to watch.

If its not possible for individual connections, then what else we can do as for as VPN connections are concerned?

regards,
Kumar
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now