titanax
asked on
ASA5510: Send logs via email
Hi,
I need to send the firewall log to an e-mail account, our MX server is located on our LAN
I have configured the following:
enable logging
logging mail 3
logging from-address asa@mydomain.com
logging recipient-address admin@mydomain.com
smtp-server 10.143.3.4
-------------------------- ---------- ---
sh logging - shows that there are messages in the "mail" - but the recipient is not getting any emails, what else do I need to configure?
What else do I need to configure?
I pretty much followed this:
http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_book09186a00806a61b0.html
I need to send the firewall log to an e-mail account, our MX server is located on our LAN
I have configured the following:
enable logging
logging mail 3
logging from-address asa@mydomain.com
logging recipient-address admin@mydomain.com
smtp-server 10.143.3.4
--------------------------
sh logging - shows that there are messages in the "mail" - but the recipient is not getting any emails, what else do I need to configure?
What else do I need to configure?
I pretty much followed this:
http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_book09186a00806a61b0.html
ASKER
thats what i suspected, but this asa is to replace the sonicwall 100 pro & the SW does not have any accounts on the MX; or thats whats the MX administrator claims.
as far as configs are concerned - have i got it nailed ?
as far as configs are concerned - have i got it nailed ?
>have i got it nailed
100% according to all Cisco published documentation
Can you ping the server IP from the ASA? It could be a simple routing issue if this is in a 'test' mode and the Sonicwall is still the primary firewall.
100% according to all Cisco published documentation
Can you ping the server IP from the ASA? It could be a simple routing issue if this is in a 'test' mode and the Sonicwall is still the primary firewall.
ASKER
haven't thought of trying to ping! LOL! will be going to site tomorrow to test it out.
Routing issue - what do you mean?
Routing issue - what do you mean?
ASKER
ping works, so i don't think its a routing issue. i've change the "logging from-address {from unauthenicated to authenicated user}"
but the mails are not recieved by the recipient.
qn:
at what intervals are logged sent out? are they defined by the buffer log size? how do i force the logging to send out an e-mail?
but the mails are not recieved by the recipient.
qn:
at what intervals are logged sent out? are they defined by the buffer log size? how do i force the logging to send out an e-mail?
Whenever any level 3 message gets genereated. This would be a critical event like interface down or something. Since it is not in production yet, unplug the outside interface and see if that generates a trap and an email.
ASKER
> Whenever any level 3 message gets genereated - the reason for this is prob coz I set "logging mail 3" right?
So I can either change the logging level to 1 or like u suggest unplug the outside intf - great, I will try it!
So I can either change the logging level to 1 or like u suggest unplug the outside intf - great, I will try it!
Change the logging level to 5 not 1
Level 3 will generate traps for all lower levels
Sets the maximum level for system log messages. For example, if you set the level to 3, then the security appliance generates system log messages for level 3, 2, 1, and 0. You can specify either the number or the name, as follows:
•0 or emergencies—System unusable.
•1 or alerts—Take immediate action.
•2 or critical—Critical condition.
•3 or errors—Error.
•4 or warnings—Warning.
•5 or notifications—Normal but significant condition.
•6 or informational—Information.
•7 or debugging—Debug messages, log FTP commands, and WWW URLs.
Level 3 will generate traps for all lower levels
Sets the maximum level for system log messages. For example, if you set the level to 3, then the security appliance generates system log messages for level 3, 2, 1, and 0. You can specify either the number or the name, as follows:
•0 or emergencies—System unusable.
•1 or alerts—Take immediate action.
•2 or critical—Critical condition.
•3 or errors—Error.
•4 or warnings—Warning.
•5 or notifications—Normal but significant condition.
•6 or informational—Information.
•7 or debugging—Debug messages, log FTP commands, and WWW URLs.
ASKER
hi lrmoore, if I want any informtion to be sent regardless of importance (except debugging) I set it to:
mail loggin 6
Am I correct?
mail loggin 6
Am I correct?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
your mailserver may not be set up to accept email from internal hosts..