Link to home
Create AccountLog in
Avatar of netcmh
netcmhFlag for United States of America

asked on

ASA logging & email

Hello,

I would like to setup multiple logging lists on my ASA5520s and have mail sent out to their respective groups.

eg.

logging list abc
logging list abc message 123456
logging list abc message 123457
logging list abc message 123458
logging mail abc
logging from-address CiscoASA@mycompany.com
logging recipient-address admin1@mycompany.com

logging list def
logging list def message 113456
logging list def message 113457
logging list def message 113458
logging mail def
logging from-address CiscoASA@mycompany.com
logging recipient-address admin2@mycompany.com

logging list ghi
logging list ghi message 133456
logging list ghi message 133457
logging list ghi message 133458
logging mail ghi
logging from-address CiscoASA@mycompany.com
logging recipient-address admin3@mycompany.com

I know the above won't work as is. Is there a way to accomplish this, besides setting up alerts on the syslog machine?

Thanks
Avatar of surbabu140977
surbabu140977
Flag of India image
ASA do send logs directly over email without syslog servers. You need to do some 30 mins reading. That's all.

http://community.spiceworks.com/how_to/show/388-cisco-asa-sending-email-alerts

Best,
Avatar of btan
btan
Avatar of netcmh
netcmh
Flag of United States of America image

ASKER

I'm sorry, but I couldn't find what I am looking for.

I've seen those pages before and I've tried reading into them again based on your suggestions.

My requirement is to send 3 different people alert emails when 3 different events happen on the ASA. Do-able? Any example might really help drive the point home to me.

Thanks
ASKER CERTIFIED SOLUTION
Avatar of btan
btan
Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
See answer
Avatar of netcmh
netcmh
Flag of United States of America image

ASKER

So, with the above you're configuring critical to include, not replace existing with, 713050; and the same with the errors.

then, as the events occur and are triggered, only the intended recepients for errors and criticals recieve the respective emails.

Help me get this straight. Thanks
Avatar of btan
btan
that is my interpretation and not tested though. thanks
Avatar of netcmh
netcmh
Flag of United States of America image

ASKER

Seeing that I would be implementing this on a live edge firewall, I would need more assurance. I hope you understand.

Thanks.
Avatar of btan
btan
noted that is why staging environment is always best. But then again, i will suggest that your org contracted support can help you verified as they would know your environment better. nothing beats the principle to confirm this which I see they will help if they valued as customer in long term basis.