Keeping track of Firewall Changes, How?

[rsp11]

Hi All,

Like many of you we have got a double firewall structure but we've also got numerous networks inside and plug into a lager network with 1000's of customers on either side. I'm looking for some sort of solution that would allow us to keep track of firewall changes. For example just yesterday one system was moving off DMZ3 to DMZ1 and 8 different entries needed to be made both on our two firewalls and on a couple of external firewalls.
How is it best of keep track of these things??

 

[tbissett]

Set up a syslog server and make sure it accepts Level 5 - Notification messages from the PIX.

You'll want to look for message ID 111008. This message ID displays commands entered by users that modify the firewall config.