Solved

How to read a firewall log

Posted on 2007-04-10
6
413 Views
Last Modified: 2010-04-09
Can you provide an example on how to read a firewall log.
0
Comment
Question by:mutec1
  • 2
  • 2
  • 2
6 Comments
 
LVL 29

Expert Comment

by:Alan Huseyin Kayahan
ID: 18889915
             Hi mutec1
                  It depends on which firewall you have hardware or software?
               *Here is for windows firewall
http://technet2.microsoft.com/WindowsServer/en/library/00fb7df9-e11b-498a-a979-e2b37a6e2ff31033.mspx?mfr=true
              *For PIX firewall, enable logging by logging enable and use a syslog server and point that syslog server with following command
               logging host inside ipaddress    (or dmz)
         
0
 

Author Comment

by:mutec1
ID: 18890496
Its a pix firewall and I'd like to understand some the terms to see if the firewall is secure or not.  What has been permitted to pass or what is being denied.  If you have an example it would be great.
0
 
LVL 29

Assisted Solution

by:Alan Huseyin Kayahan
Alan Huseyin Kayahan earned 200 total points
ID: 18891012
               
                *If you use PDM or ASDM interface for PIX, then you may see logs in PDM/ASDM window, when you enable logging as i mentioned above.
                *Here is a detailed article for PIX logging http://www.ciscopress.com/articles/article.asp?p=424447&seqNum=2&rl=1
                *Below is a connection attempt log from one side to other denied by ACL.
%PIX-3-710003 {TCP | UDP} access denied by ACL from source_address/source_port to interface_name: dest_address/service
               *Here are more log messages http://safari.peachpit.com/1587051583/app02lev1sec3

Regards
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 32

Expert Comment

by:rsivanandan
ID: 18891033
0
 

Author Comment

by:mutec1
ID: 18891220
I'm going to be looking at a configuration file, as the user will not let me have a copy of the firewall rules. I want to make sure I can understand what I am seeing.  Would you be able to post a pix configuration file and go over some basics.

Thanks
0
 
LVL 32

Accepted Solution

by:
rsivanandan earned 300 total points
ID: 18894956
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html

The link above will show you various configuration samples, now what kind of environment is that you're looking at is something that I would not know.

Cheers,
Rajesh
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Occasionally, we encounter connectivity issues that appear to be isolated to cable internet service.  The issues we typically encountered were reset errors within Internet Explorer when accessing web sites or continually dropped or failing VPN conne…
I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.
A company’s greatest vulnerability is their email. CEO fraud, ransomware and spear phishing attacks are the no1 threat to a company’s security. Cybercrime is responsible for the largest loss of money to companies today with losses projected to r…

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now