Corporate Headquarters Cisco Systems, Inc.
170 West Tasman Drive San Jose, CA 95134-1706 USA
http://www.cisco.com Tel: 408 526-4000
800 553-NETS (6387) Fax: 408 526-4100
For the Cisco PIX 500 Series and Cisco ASA Series Security Appliance
Software Version 7.1
Text Part Number: OL-6721-02
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCSP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0501R)
Copyright © 2005 Cisco Systems, Inc. All rights reserved.
Document Objectives
xxxiiiAudience
xxxiiiDocument Organization
xxxivDocument Conventions
xxxivRelated Documentation
xxxivObtaining Documentation
xxxivCisco.com
xxxvDocumentation DVD
xxxvOrdering Documentation
xxxvDocumentation Feedback
xxxviCisco Product Security Overview
xxxviReporting Security Problems in Cisco Products
xxxviObtaining Technical Assistance
xxxviiCisco Technical Support Website
xxxviiSubmitting a Service Request
xxxviiDefinitions of Service Request Severity
xxxviiiObtaining Additional Publications and Information
xxxviiiC H A P T E R 1 Configuring Logging and SNMP 1-1
Configuring SNMP
1-1SNMP Overview
1-1Enabling SNMP
1-3Configuring and Managing Logs
1-4Logging Overview
1-4Logging in Multiple Context Mode
1-5Enabling and Disabling Logging
1-5Enabling Logging to All Configured Output Destinations
1-6Disabling Logging to All Configured Output Destinations
1-6Viewing the Log Configuration
1-6Configuring Log Output Destinations
1-7Log Output Destination Overview
1-8Designating a Syslog Server as an Output Destination
1-8Designating an E-mail Address as an Output Destination
1-10Designating ASDM as an Output Destination
1-11Viewing Logs Using a Telnet Session
1-12hostname(config)# no logging monitorDesignating the Log Buffer as an Output Destination
1-13Filtering System Log Messages to be Sent to an Output Destination
1-15Message Filtering Overview
1-15Filtering System Log Messages by Class
1-16Filtering System Log Messages with Custom Message Lists
1-17Customizing the Log Configuration
1-19Configuring the Logging Queue
1-19Including the Date and Time in System Log Messages
1-19Including the Device ID in System Log Messages
1-19PIX|ASA Generating System Log Messages in EMBLEM Format
1-20Disabling a System Log Message
1-21Changing the Severity Level of a System Log Message
1-21Changing the Amount of Internal Flash Memory Available for Logs
1-22Understanding System Log Messages
1-23System Log Message Format
1-23Severity Levels
1-24Variables Used in System Log Messages
1-24C H A P T E R 2 System Log Messages 2-1
Messages 101001 to 199009
2-1101001
2-1101002
2-2101003, 101004
2-2101005
2-2102001
2-2103001
2-3103002
2-3103003
2-3103004
2-4103005
2-4104001, 104002
2-4104003
2-5104004
2-5105001
2-5105002
2-5105003
2-6105004
2-6105005
2-6105006, 105007
2-7105008
2-7105009
2-7105010
2-8105011
2-8105020
2-8105021
2-8105031
2-9105032
2-9105034
2-9105035
2-9105036
2-9105037
2-10105038
2-10105039
2-10105040
2-11105042
2-11105043
2-11105044
2-11105045
2-12105046
2-12105047
2-12106001
2-13106002
2-13106006
2-13106007
2-14106010
2-14106011
2-14106012
2-14106013
2-15106014
2-15106015
2-15106016
2-15106017
2-16106018
2-16106020
2-16106021
2-17106022
2-17106023
2-18106024
2-18106025, 106026
2-18106027
2-19106100
2-19106101
2-20107001
2-20107002
2-20108002
2-21108003
2-21109001
2-21109002
2-21109003
2-22109005
2-22109006
2-22109007
2-22109008
2-23109010
2-23109011
2-23109012
2-23109013
2-24109014
2-24109016
2-24109017
2-24109018
2-25109019
2-25109020
2-25109021
2-25109022
2-26109023
2-26109024
2-26109025
2-26109026
2-27109027
2-27109028
2-27109029
2-28109030
2-28109031
2-28109032
2-29110001
2-29111001
2-29111002
2-30111003
2-30111004
2-30111005
2-30111007
2-31111008
2-31111009
2-31111111
2-31112001
2-31113001
2-32113003
2-32113004
2-32113005
2-33113006
2-33113007
2-33113008
2-33113009
2-34113010
2-34113011
2-34113012
2-34113013
2-35113014
2-35113015
2-35113016
2-35113017
2-36113018
2-36113019
2-36113020
2-37114001
2-37114002
2-38114003
2-38114004
2-39114005
2-39114006
2-39114007
2-40114008
2-41114009
2-41114010
2-42114011
2-43114012
2-44114013
2-44114014
2-45114015
2-46114016
2-46114017
2-47114018
2-48114019
2-48114020
2-49199001
2-49199002
2-50199003
2-50199005
2-50199006
2-50199907
2-51199908
2-51199909
2-51Messages 201002 to 217001
2-51201002
2-52201003
2-52201004
2-52201005
2-53201006
2-53201008
2-53201009
2-53201010
2-54201012
2-54201013
2-55202001
2-55202005
2-55202011
2-56208005
2-56209003
2-56209004
2-57209005
2-57210001
2-57210002
2-58210003
2-58210005
2-58210006
2-58210007
2-59210008
2-59210010
2-59210020
2-59210021
2-60210022
2-60211001
2-60211003
2-60212001
2-61212002
2-61212003
2-62212004
2-62212005
2-62212006
2-62213001
2-63213002
2-63213003
2-63213004
2-63214001
2-64215001
2-64217001
2-64216001
2-64216002
2-65216003
2-65Messages 302003 to 326028
2-66302003
2-66302004
2-66302009
2-67302010
2-67302012
2-67302013
2-67302014
2-68302015
2-70302016
2-70302017
2-71302018
2-71302019
2-72302020
2-72302021
2-72302302
2-73303002
2-73303003
2-73303004
2-73304001
2-74304002
2-74304003
2-74304004
2-74304005
2-75304006
2-75304007
2-75304008
2-75304009
2-76305005
2-76305006
2-76305007
2-77305008
2-77305009
2-78305010
2-78305011
2-78305012
2-78308001
2-79308002
2-79311001
2-79311002
2-79311003
2-80311004
2-80312001
2-80313001
2-80313003
2-81313004
2-81314001
2-81315004
2-81315011
2-82316001
2-83317001
2-83317002
2-84317003
2-84317004
2-84317005
2-84318001
2-84318002
2-85318003
2-85318004
2-85318005
2-85318006
2-85318007
2-86318008
2-86318009
2-86319001
2-86319002
2-87319003
2-87319004
2-87320001
2-87321001
2-88321002
2-88321003
2-88321004
2-88322001
2-88322002
2-89322003
2-89322004
2-89323004
2-90323005
2-90324000
2-91324001
2-91324002
2-92324003
2-92324004
2-92324005
2-93324006
2-93324007
2-93325001
2-93325002
2-94326001
2-94326002
2-94326004
2-94326005
2-95326006
2-95326007
2-95326008
2-95326009
2-96326010
2-96326011
2-96326012
2-96326013
2-97326014
2-97326015
2-97326016
2-97326017
2-98326019
2-98326020
2-98326021
2-98326022
2-99326023
2-99326024
2-99326025
2-99326026
2-100326027
2-100326028
2-100Messages 400000 to 421007
2-1004000nn
2-100401001
2-103401002
2-103401003
2-103401004
2-104401005
2-104402101
2-104402102
2-105402103
2-105402106
2-105402114
2-105402115
2-106402116
2-106402117
2-107402118
2-108402119
2-108402120
2-109402121
2-109402122
2-110402123
2-110403101
2-110403102
2-111403103
2-111403104
2-111403106
2-111403107
2-112403108
2-112403109
2-112403110
2-112403500
2-113403501
2-113403502
2-113403503
2-114403504
2-114403505
2-114403506
2-115404101
2-115404102
2-115405001
2-115405101
2-116405002
2-116405101
2-116405102
2-117405103
2-117405104
2-117405105
2-118405201
2-118406001
2-118406002
2-118407001
2-119407002
2-119407003
2-120408001
2-120408002
2-120409001
2-120409002
2-121409003
2-121409004
2-121409005
2-121409006
2-122409007
2-122409008
2-122409009
2-122409010
2-123409011
2-123409012
2-123409013
2-123409023
2-124410001
2-124411001
2-124411002
2-124411003
2-125411004
2-125412001
2-125412002
2-126413001
2-126413002
2-126413003
2-127413004
2-127414001
2-127414002
2-128415001
2-128415002
2-128415003
2-129415004
2-129415005
2-130415006
2-130415007
2-131415008
2-131415009
2-132415010
2-132415011
2-133415012
2-133415013
2-134415014
2-134416001
2-135417001
2-135417004
2-135417006
2-136418001
2-136419001
2-136419002
2-137420001
2-137420002
2-138420003
2-138Messages 500001 to 507001
2-141500001
2-141500002
2-141500003
2-141500004
2-142501101
2-142502101
2-142502102
2-142502103
2-143502111
2-143502112
2-143503001
2-143504001
2-144504002
2-144505001
2-144505002
2-144505003
2-144505004
2-145505005
2-145505006
2-145505007
2-145505008
2-146505009
2-146506001
2-147507001
2-148Messages 602101 to 609002
2-149602101
2-149602103
2-149602104
2-149602201
2-150602202
2-150602203
2-150PIX|ASAPIX|ASA602303
2-151602304
2-151603101
2-151603102
2-152603103
2-152603104
2-152603105
2-152603106
2-153603107
2-153603108
2-153603109
2-153604101
2-154604102
2-154604103
2-154604104
2-154605004
2-155605005
2-155606001
2-156606002
2-156606003
2-156606004
2-157607001
2-157608001
2-157609001
2-158609002
2-158610001
2-158610002
2-158610101
2-159611101
2-159611102
2-159611103
2-159611104
2-160611301
2-160611302
2-160611303
2-160611304
2-161611305
2-161611306
2-161611307
2-161611308
2-161611309
2-162611310
2-162611311
2-162611312
2-162611313
2-163611314
2-163611315
2-163611316
2-163611317
2-164611318
2-164611319
2-164611320
2-165611321
2-165611322
2-165611323
2-165612001
2-166612002
2-166612003
2-166613001
2-166613002
2-167613003
2-167614001
2-167614002
2-167615001
2-167615002
2-168616001
2-168617001
2-168617002
2-168617003
2-169617004
2-169620001
2-169620002
2-169621001
2-170621002
2-170621003
2-170621006
2-170621007
2-171Messages 701001 to 725014
2-171701001
2-171701002
2-172702201
2-172702202
2-172702203
2-172702204
2-173702205
2-173702206
2-173702207
2-173702208
2-174702209
2-174702210
2-174702211
2-174702212
2-174PIX|ASAPIX|ASAPIX|ASA702305
2-175702307
2-175703001
2-176703002
2-176709001, 709002
2-176709003
2-176709004
2-177709005
2-177709006
2-177709007
2-177710001
2-178710002
2-178710003
2-178710004
2-179710005
2-179710006
2-179711001
2-180711002
2-180713004
2-180713006
2-180713008
2-181713009
2-181713010
2-181713012
2-182713014
2-182713016
2-182713017
2-182713018
2-183713020
2-183713022
2-183713024
2-183713025
2-184713026
2-184713027
2-184713028
2-184713029
2-185713030
2-185713031
2-185713032
2-185713033
2-186713034
2-186713035
2-186713036
2-186713037
2-187713039
2-187713040
2-187713041
2-187713042
2-188713043
2-188713047
2-188713048
2-188713049
2-189713050
2-189713051
2-189713052
2-189713056
2-190713059
2-190713060
2-190713061
2-191713062
2-191713063
2-191713065
2-191713066
2-192713068
2-192713072
2-192713073
2-192713074
2-193713075
2-193713076
2-193713078
2-193713081
2-194713082
2-194713083
2-194713084
2-194713085
2-195713086
2-195713088
2-195713092
2-195713094
2-196713098
2-196713099
2-196713102
2-196713103
2-197713104
2-197713105
2-197713107
2-197713109
2-198713112
2-198713113
2-198713114
2-199713115
2-199713116
2-199713117
2-199713118
2-200713119
2-200713120
2-200713121
2-200713122
2-201713123
2-201713124
2-201713127
2-201713128
2-202713129
2-202713130
2-202713131
2-202713132
2-203713133
2-203713134
2-203713135
2-203713136
2-204713137
2-204713138
2-204713139
2-204713140
2-205713141
2-205713142
2-205713143
2-206713144
2-206713145
2-206713146
2-206713147
2-207713148
2-207713149
2-207713152
2-207713154
2-208713155
2-208713156
2-208713157
2-208713158
2-209713159
2-209713160
2-209713161
2-210713162
2-210713163
2-210713164
2-210713165
2-211713166
2-211713167
2-211713168
2-211713169
2-212713170
2-212713171
2-212713172
2-212713174
2-213713176
2-213713177
2-213713178
2-213713179
2-214713182
2-214713184
2-214713185
2-214713186
2-215713187
2-215713189
2-215713190
2-215713193
2-216713194
2-216713195
2-216713196
2-216713197
2-217713198
2-217713199
2-217713203
2-217713204
2-218713205
2-218713206
2-218713208
2-218713209
2-219713210
2-219713211
2-219713212
2-220713213
2-220713214
2-220713215
2-221713216
2-221713217
2-221713218
2-221713219
2-222713220
2-222713221
2-222713222
2-222713223
2-223713224
2-223713225
2-223713226
2-223713228
2-224713229
2-224713230
2-224713231
2-225713232
2-225713233
2-225713234
2-226713235
2-226713236
2-226713237
2-227713238
2-227713900
2-227713901
2-228713902
2-228713903
2-228713904
2-228713905
2-229713906
2-229714001
2-229714002
2-229714003
2-229714004
2-230714005
2-230714006
2-230714007
2-230714011
2-230715001
2-231715004
2-231715005
2-231715006
2-231715007
2-232715008
2-232715009
2-232715013
2-232715019
2-233715020
2-233715021
2-233715022
2-233715027
2-234715028
2-234715033
2-234715034
2-234715035
2-235715036
2-235715037
2-235715038
2-235715039
2-236715040
2-236715041
2-236715042
2-236715044
2-237715045
2-237715046
2-237715047
2-237715048
2-237715049
2-238715050
2-238715051
2-238715052
2-238715053
2-239715054
2-239715055
2-239715056
2-239715057
2-239715058
2-240715059
2-240715060
2-240715061
2-240715062
2-241715063
2-241715064
2-241715065
2-241715066
2-242715067
2-242715068
2-242715069
2-243715070
2-243715071
2-243715072
2-243715074
2-244715075
2-244715076
2-245715077
2-245716001
2-246716002
2-246716003
2-247716004
2-247716005
2-247716006
2-247716007
2-248716008
2-248716009
2-248716010
2-248716011
2-249716012
2-249716013
2-249716014
2-249716015
2-249716016
2-250716017
2-250716018
2-250716019
2-250716020
2-250716021
2-251716022
2-251716023
2-251716024
2-251716025
2-252716026
2-252716027
2-252716028
2-252716029
2-253716030
2-253716031
2-253716032
2-254716033
2-254716034
2-254716035
2-254716036
2-255716037
2-255716038
2-255716039
2-255716040
2-256716041
2-256716042
2-256716043
2-256716044
2-257717001
2-261717002
2-261717003
2-261717004
2-262717005
2-262717006
2-262717007
2-262717008
2-263717009
2-263717010
2-263717011
2-263717012
2-264717013
2-264717014
2-264717015
2-265717016
2-265717017
2-265717018
2-266717019
2-266717021
2-266717022
2-267717023
2-267717024
2-267717025
2-268717026
2-268717027
2-268717028
2-269717029
2-269717030
2-269717031
2-269718001
2-270718002
2-270718003
2-270718004
2-271718005
2-271718006
2-271718007
2-272718008
2-272718009
2-272718010
2-273718011
2-273718012
2-273718013
2-273718014
2-274718015
2-274718016
2-274718017
2-274718018
2-275718019
2-275718020
2-275718021
2-275718022
2-276718023
2-276718024
2-276718025
2-276718026
2-277718027
2-277718028
2-277718029
2-277718030
2-278718031
2-278718032
2-278718033
2-278718034
2-279718035
2-279718036
2-279718037
2-279718038
2-280718039
2-280718040
2-280718041
2-280718042
2-281718043
2-281718044
2-281718045
2-281718046
2-281718047
2-282718048
2-282718049
2-282718050
2-282718051
2-282718052
2-283718053
2-283718054
2-283718055
2-283718056
2-283718057
2-284718058
2-284718059
2-284718060
2-284718061
2-285718062
2-285718063
2-285718064
2-285718065
2-286718066
2-286718067
2-286718068
2-286718069
2-287718070
2-287718071
2-287718072
2-287718073
2-287718074
2-288718075
2-288718076
2-288718077
2-288718078
2-289718079
2-289718080
2-289718081
2-289718084
2-290718085
2-290718086
2-290718087
2-290718088
2-291719001
2-291719002
2-291719003
2-291719004
2-292719005
2-292719006
2-292719007
2-292719008
2-293719009
2-293719010
2-293719011
2-293719012
2-294719013
2-294719014
2-294719015
2-294719016
2-295719017
2-295719018
2-295719019
2-296719020
2-296719021
2-296719022
2-296719023
2-297719024
2-297719025
2-297719026
2-297720001
2-298720002
2-298720003
2-298720004
2-298720005
2-299720006
2-299720007
2-299720008
2-299720009
2-300720010
2-300720011
2-300720012
2-300720013
2-301720014
2-301720015
2-301720016
2-301720017
2-302720018
2-302720019
2-302720020
2-302720021
2-303720022
2-303720023
2-304720024
2-304720025
2-304720026
2-305720027
2-305720028
2-305720029
2-305720030
2-306720031
2-306720032
2-306720033
2-307720034
2-307720035
2-307720036
2-308720037
2-308720038
2-308720039
2-309720040
2-309720041
2-309720042
2-310720043
2-310720044
2-310720045
2-311720046
2-311720047
2-311720048
2-312720049
2-312720050
2-312720051
2-313720052
2-313720053
2-313720054
2-314720055
2-314720056
2-314720057
2-315720058
2-315720059
2-315720060
2-315720061
2-316720062
2-316720063
2-316720064
2-317720065
2-317720066
2-317720067
2-318720068
2-318720069
2-318720070
2-319720071
2-319720072
2-319720073
2-320A P P E N D I X A Messages Listed by Severity Level A-1
Other Severities
A-1Alert Messages, Severity 1
A-1Critical Messages, Severity 2
A-3Error Messages, Severity 3
A-4Warning Messages, Severity 4
A-13Notification Messages, Severity 5
A-19Informational Messages, Severity 6
A-25Debugging Messages, Severity 7
A-34IN D E X
This preface describes:
• Document Objectives, page xxxiii
• Audience, page xxxiii
• Document Organization, page xxxiv
• Document Conventions, page xxxiv
• Related Documentation, page xxxiv
• Obtaining Documentation, page xxxiv
• Obtaining Technical Assistance, page xxxvii
Document Objectives
This guide describes the system log (syslog) messages generated by the Cisco ASA 5500 Series Security Appliance software Version 7.0. Messages that display on the console from non-syslog errors are not listed.
Audience
This guide is intended for network managers who perform any of the following tasks:
• Managing network security
• Configuring, administering, and troubleshooting firewalls
This guide assumes that you are familiar with the commands and configuration options described in the Cisco Security Appliance Command Reference. In addition, you should be familiar with the network within which the security appliance operates.
Document Organization
This guide is organized as follows:
• Chapter 1, “Configuring Logging and SNMP” describes the system log message function, and explains the format of log messages.
• Chapter 2, “System Log Messages” lists the system log messages, indicates the probable cause of each message, and provides instructions for resolving the condition that caused the log message.
• Appendix A, “Messages Listed by Severity Level” lists message numbers and text by each severity level.
Document Conventions
This guide uses the following conventions:
• Filenames, directory names, and arguments for which you supply values are in italics.
• The symbol ^ represents the key labeled Ctrl (control). To enter a control key; for example, ^z, hold down the Ctrl key while you press the z key.
• Command names, keys, buttons, and keywords in text are shown in boldface. The security appliance commands are described in detail in the Cisco Security Appliance Command Reference.
• Variables in command syntax descriptions are shown in italics. Command options in square brackets [ ] can be optionally entered, and parameters separated by a vertical bar ( | ) require you to enter one parameter, but not the other(s).
• Examples depict screen displays and the command line in screen font.
• Information you need to enter in examples is shown in boldface screen font.
• Variables that require you to supply a value are shown in italic screen font.
• Selecting a menu item (or screen) is indicated by the following convention:
Click screen1>screen2>screen3.
Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the manual.
Related Documentation
Use this document with the security appliance documentation set, which is available online at the following website:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix_sw/index.htm
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/univercd/home/home.htm You can access the Cisco website at this URL:
http://www.cisco.com
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Documentation DVD
Cisco documentation and additional literature are available in a Documentation DVD package, which may have shipped with your product. The Documentation DVD is updated regularly and may be more current than printed documentation. The Documentation DVD package is available as a single unit.
Registered Cisco.com users (Cisco direct customers) can order a Cisco Documentation DVD (product number DOC-DOCDVD=) from the Ordering tool or Cisco Marketplace.
Cisco Ordering tool:
http://www.cisco.com/en/US/partner/ordering/
Cisco Marketplace:
http://www.cisco.com/go/marketplace/
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm You can order Cisco documentation in these ways:
• Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:
http://www.cisco.com/en/US/partner/ordering/
• Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 1 800 553-NETS (6387).
Documentation Feedback
You can send comments about technical documentation to [email protected].
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering 170 West Tasman Drive
San Jose, CA 95134-9883 We appreciate your comments.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html From this site, you can perform these tasks:
• Report security vulnerabilities in Cisco products.
• Obtain assistance with security incidents that involve Cisco products.
• Register to receive security information from Cisco.
A current list of security advisories and notices for Cisco products is available at this URL:
http://www.cisco.com/go/psirt
If you prefer to see advisories and notices as they are updated in real time, you can access a Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed from this URL:
http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you might have identified a vulnerability in a Cisco product, contact PSIRT:
• Emergencies —[email protected]
• Nonemergencies —[email protected]
Tip We encourage you to use Pretty Good Privacy (PGP) or a compatible product to encrypt any sensitive information that you send to Cisco. PSIRT can work from encrypted information that is compatible with PGP versions 2.x through 8.x.
Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one that has the most recent creation date in this public key server list:
http://pgp.mit.edu:11371/pks/lookup?search=psirt%40cisco.com&op=index&exact=on
In an emergency, you can also reach PSIRT by telephone:
• 1 877 228-7302
• 1 408 525-6532
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.
Cisco Technical Support Website
The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year, at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password.
If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Note Use the Cisco Product Identification (CPI) tool to locate your product serial number before submitting a web or phone request for service. You can access the CPI tool from the Cisco Technical Support Website by clicking the Tools & Resources link under Documentation & Tools. Choose Cisco Product Identification Tool from the Alphabetical Index drop-down list, or click the Cisco Product
Identification Tool link under Alerts & RMAs. The CPI tool offers three search options: by product ID or model name; by tree view; or for certain products, by copying and pasting show command output.
Search results show an illustration of your product with the serial number label location highlighted.
Locate the serial number label on your product and record the information before placing a service call.
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone.
(S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227) EMEA: +32 2 704 55 55
USA: 1 800 553-2447
For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—Your network is “down,” or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
• Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Visit Cisco Marketplace, the company store, at this URL:
http://www.cisco.com/go/marketplace/
• Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press at this URL:
http://www.ciscopress.com
• Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and networking investments. Each quarter, Packet delivers coverage of the latest industry trends, technology breakthroughs, and Cisco products and solutions, as well as network deployment and troubleshooting tips, configuration examples, customer case studies, certification and training information, and links to scores of in-depth online resources. You can access Packet magazine at this URL:
http://www.cisco.com/packet
• iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies learn how they can use technology to increase revenue, streamline their business, and expand services. The publication identifies the challenges facing these companies and the technologies to help solve them, using real-world case studies and business strategies to help readers make sound technology investment decisions. You can access iQ Magazine at this URL:
http://www.cisco.com/go/iqmagazine
• Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:
http://www.cisco.com/ipj
• World-class networking training is available from Cisco. You can view current offerings at this URL:
http://www.cisco.com/en/US/learning/index.html
Configuring Logging and SNMP
This chapter describes how to configure logging and SNMP. It also describes the contents of system log messages and the system log message format. This chapter does not provide comprehensive information about all monitoring and logging commands and options. For detailed descriptions and additional commands, see the Cisco Security Appliance Command Reference.
This chapter includes the following sections:
• Configuring SNMP, page 1-1
• Configuring and Managing Logs, page 1-4
Configuring SNMP
This section describes how to use SNMP and includes the following topics:
• SNMP Overview, page 1-1
• Enabling SNMP, page 1-3
SNMP Overview
The security appliance provides support for network monitoring using SNMP V1 and V2c. The security appliance supports traps and SNMP read access, but does not support SNMP write access.
You can configure the security appliance to send traps (event notifications) to a network management station (NMS), or you can use the NMS to browse the MIBs on the security appliance. MIBs are a collection of definitions, and the security appliance maintains a database of values for each definition.
Browsing a MIB entails issuing an SNMP get request from the NMS. Use CiscoWorks for Windows or any other SNMP V1, MIB-II compliant browser to receive SNMP traps and browse a MIB.
Table 1-1 lists supported MIBs and traps for the security appliance and, in multiple mode, for each context. You can download Cisco MIBs from the following website.
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml After you download the MIBs, compile them for your NMS.
Table 1-1 SNMP MIB and Trap Support
MIB or Trap Support Description
SNMP core traps The security appliance sends the following core SNMP traps:
• authentication—An SNMP request fails because the NMS did not authenticate with the correct community string.
• linkup—An interface has transitioned to the “up” state.
• linkdown—An interface is down, for example, if you removed the nameif command.
• coldstart—The security appliance is running after a reload.
MIB-II The security appliance supports browsing of the following groups and
tables:
• system
IF-MIB The Cisco ASA supports browsing of the following tables:
• ifTable
• ifXTable
RFC1213-MIB The Cisco ASA supports browsing of the following table:
• ip.ipAddrTable
SNMPv2-MIB The Cisco ASA supports browsing the following:
• snmp
ENTITY-MIB The security appliance supports browsing of the following groups and tables:
• entPhysicalTable
• entLogicalTable
The security appliance supports browsing of the following traps:
• snmp-server enable traps entity {config-change|fru-insert|fru-remove}
CISCO-IPSEC-FLOW-MONITOR-MIB The security appliance supports browsing of the MIB.
The security appliance supports browsing of the following traps:
• snmp-server enable traps ipsec {start|stop}
CISCO-REMOTE-ACCESS-MONITOR-MIB The security appliance supports browsing of the MIB.
The security appliance supports browsing of the following traps:
• snmp-server enable traps remote-access {session-threshold-exceeded}
CISCO-CRYPTO-ACCELERATOR-MIB The security appliance supports browsing of the MIB.
ALTIGA-GLOBAL-REG The security appliance supports browsing of the MIB.
Cisco Firewall MIB The security appliance supports browsing of the following groups:
• cfwSystem
The information is cfwSystem.cfwStatus, which relates to failover status, pertains to the entire device and not just a single context.
Enabling SNMP
The SNMP agent that runs on the security appliance performs two functions:
• Replies to SNMP requests from NMSs.
• Sends traps (event notifications) to NMSs.
To enable the SNMP agent and identify an NMS that can connect to the security appliance, follow these steps:
Step 1 To identify the IP address of the NMS that can connect to the security appliance, enter the following command:
hostname(config)# snmp-server host interface_name ip_address [trap | poll] [community text] [version 1 | 2c] [udp-port port]
Specify trap or poll if you want to limit the NMS to receiving traps only or browsing (polling) only. By default, the NMS can use both functions.
SNMP traps are sent on UDP port 162 by default. You can change the port number using the udp-port keyword.
Step 2 To specify the community string, enter the following command:
hostname(config)# snmp-server community key
The SNMP community string is a shared secret between the security appliance and the NMS. The key is a case-sensitive value up to 32 characters in length. Spaces are not permitted.
Step 3 (Optional) To set the SNMP server location or contact information, enter the following command:
hostname(config)# snmp-server {contact | location} text
Step 4 To enable the security appliance to send traps to the NMS, enter the following command:
hostname(config)# snmp-server enable [traps [all | feature [trap1] [trap2]] [...]]
By default, SNMP core traps are enabled (snmp). If you do not enter a trap type in the command, syslog is the default. To enable or disable all traps, enter the all option. For snmp, you can identify each trap type separately. See Table 1-1 on page 1-2 for a list of traps.
Cisco Memory Pool MIB The security appliance supports browsing of the following table:
• ciscoMemoryPoolTable—The memory usage described in this table applies only to the security appliance general-purpose processor, and not to the network processors.
Cisco Process MIB The security appliance supports browsing of the following table:
• cpmCPUTotalTable
Cisco Syslog MIB The security appliance supports the following trap:
• clogMessageGenerated You cannot browse this MIB.
Table 1-1 SNMP MIB and Trap Support (continued)
MIB or Trap Support Description
Step 5 To enable system messages to be sent as traps to the NMS, enter the following command:
hostname(config)# logging history level
You must also enable syslog traps using the preceding snmp-server enable traps command.
Step 6 To enable logging, so system messages are generated and can then be sent to an NMS, enter the following command:
hostname(config)# logging on
The following example sets the security appliance to receive requests from host 192.168.3.2 on the inside interface.
hostname(config)# snmp-server host 192.168.3.2 hostname(config)# snmp-server location building 42 hostname(config)# snmp-server contact Pat lee
hostname(config)# snmp-server community ohwhatakeyisthee
Configuring and Managing Logs
This section describes the logging functionality and configuration. It also describes the system log message format, options and variables.
• Logging Overview, page 1-4
• Logging in Multiple Context Mode, page 1-5
• Enabling and Disabling Logging, page 1-5
• Configuring Log Output Destinations, page 1-7
• Filtering System Log Messages to be Sent to an Output Destination, page 1-15
• Customizing the Log Configuration, page 1-19
• Understanding System Log Messages, page 1-23
Logging Overview
security appliance system logs provide you with logging information for monitoring and troubleshooting the security appliance. The logging configuration is very flexible and enables you to customize many aspects of how the security appliance handles system log messages.
Using the logging feature, you can do the following:
• Specify which system log messages should be logged.
• Disable or change the severity level of a system log message.
• Specify one or more locations where system log messages should be sent, including the console, an internal buffer, one or more syslog servers, the ASDM, an SNMP management station, specified e-mail addresses, or to Telnet and SSH sessions.
• Configure and manage system log messages in groups, such as by severity level or class of message.
• Specify what happens to the contents of the internal buffer when the buffer becomes full and wraps around: you can configure the security appliance to send the buffer contents to an FTP server or to save the contents to internal Flash memory.
• Send log files to an FTP server.
• Save log files in internal Flash memory.
• Monitor system log messages remotely by using ASDM, Telnet and SSH sessions, or by downloading to a Web browser the contents of the internal log buffer.
You can choose to send all system log messages, or subsets of system log messages, to any or all output locations. You can filter which system log messages are sent to which locations by the severity of the system log message, the class of the system log message, or by creating a custom log message list.
Logging in Multiple Context Mode
Logging for an Cisco ASA running in multiple context mode functions somewhat differently than for an Cisco ASA running in single context mode. In single context mode, all logging messages generated by the system appear in a single log. In multiple context mode, there are two types of logs that are configured and accessed in different locations: logs that appear in individual security contexts, and a log that appears in the Admin context.
Just as each security context has its own configuration, each security context also has its own logging configuration and system message logs. A security context’s message log includes messages related to features that are enabled for that context. For example, context logs include messages related to security policies, routing, logging, and configuration changes for that context. Like an Cisco ASA running in single context mode, logging in security contexts is not enabled by default. If you want logs to be kept for a security context, you must access the security context and configure logging. Similarly, you must access the security context in order to view log messages for that context.
In contrast, logs in the Admin context contain messages related to the overall physical device and overall system configuration. This includes messages related to events and features configured in the Admin context, such as failover, and it also includes messages related to events and features configured in the system execution space, such as interface settings. In the Admin context, you can only view the administration log; you cannot view logs for individual security contexts in the Admin context. If you want logs to be kept for the Admin context, you must access the Admin context and configure logging.
Similarly, you must access the Admin context in order to view log messages for that context.
You cannot configure logging or view any logging information in the system execution space.
You can configure logging so that each messages includes the logging device ID for a security context;
if you do so, each message includes the name of the context in which the message occurred. If you enable the logging device ID for the Admin context, messages that originate in the system execution space use a device ID of system; messages that originate in the Admin context use a device ID of Admin. For more information about enabling logging device IDs, see Including the Device ID in System Log Messages, page 1-19.
For more information about security contexts, see the chapter titled “Enabling Multiple Context Mode”
in the Cisco Security Appliance Command Line Configuration Guide.
Enabling and Disabling Logging
This section describes how to enable and disable logging on the security appliance. It includes the following sections:
• Enabling Logging to All Configured Output Destinations, page 1-6
