Solved

How to read a firewall log

Posted on 2007-04-10
6
412 Views
Last Modified: 2010-04-09
Can you provide an example on how to read a firewall log.
0
Comment
Question by:mutec1
  • 2
  • 2
  • 2
6 Comments
 
LVL 29

Expert Comment

by:Alan Huseyin Kayahan
Comment Utility
             Hi mutec1
                  It depends on which firewall you have hardware or software?
               *Here is for windows firewall
http://technet2.microsoft.com/WindowsServer/en/library/00fb7df9-e11b-498a-a979-e2b37a6e2ff31033.mspx?mfr=true
              *For PIX firewall, enable logging by logging enable and use a syslog server and point that syslog server with following command
               logging host inside ipaddress    (or dmz)
         
0
 

Author Comment

by:mutec1
Comment Utility
Its a pix firewall and I'd like to understand some the terms to see if the firewall is secure or not.  What has been permitted to pass or what is being denied.  If you have an example it would be great.
0
 
LVL 29

Assisted Solution

by:Alan Huseyin Kayahan
Alan Huseyin Kayahan earned 200 total points
Comment Utility
               
                *If you use PDM or ASDM interface for PIX, then you may see logs in PDM/ASDM window, when you enable logging as i mentioned above.
                *Here is a detailed article for PIX logging http://www.ciscopress.com/articles/article.asp?p=424447&seqNum=2&rl=1
                *Below is a connection attempt log from one side to other denied by ACL.
%PIX-3-710003 {TCP | UDP} access denied by ACL from source_address/source_port to interface_name: dest_address/service
               *Here are more log messages http://safari.peachpit.com/1587051583/app02lev1sec3

Regards
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 32

Expert Comment

by:rsivanandan
Comment Utility
0
 

Author Comment

by:mutec1
Comment Utility
I'm going to be looking at a configuration file, as the user will not let me have a copy of the firewall rules. I want to make sure I can understand what I am seeing.  Would you be able to post a pix configuration file and go over some basics.

Thanks
0
 
LVL 32

Accepted Solution

by:
rsivanandan earned 300 total points
Comment Utility
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html

The link above will show you various configuration samples, now what kind of environment is that you're looking at is something that I would not know.

Cheers,
Rajesh
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Occasionally, we encounter connectivity issues that appear to be isolated to cable internet service.  The issues we typically encountered were reset errors within Internet Explorer when accessing web sites or continually dropped or failing VPN conne…
I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now