All Apps and Add-ons

How to view Access Lists being utilized on Cisco ASA

kgangulw
Engager

Hello,

I have a new Splunk windows instance running. We have configured our Cisco ASA to send syslog data using UDP 514 and created a data input on Splunk listening on UDP 514.

The event type has been set to "cisco:asa"
Index is the default index.

Now we see data being collected on the index, so no problems there.

We installed the Add-on for Cisco ASA app with the hope it will help us see a graphical representation of the Access Control Policies being utilized by the ASA. Does anyone know if this can be achieved with this app? or do we need something else.

Thank you.

0 Karma

mmccul
SplunkTrust
SplunkTrust

If you make sure every access list has the log keyword, you can then analyze the 106100 log events generated and do charts based on the hexid in the log event. Those hexids are unique to the rule.

0 Karma

jimmy_ford
New Member

You will not see the ACL's but you will see the connections made or denied based on the ACL's. You must have logging down to the informational level as well.

Hope this answers your question.

Cheers!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...