Pix 501 question

[karmic]

I have a small client with a pix 501, using the kiwi syslog daemon to log everything from the pix. This works fine.

Is there anything besides websense that works with the pix for internet monitoring? I don't like having monitoring done by a 3rd party company, prefer to have something onsite they can control. Or is there a program that can decipher the syslogs to show who's surfing what and who's spending the most time online so that anybody can understand them?

I use different linux packages for monitoring, but just curious if the pix is capable.

Thanks.

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[maravila]

Hi there,

Well websense is used for URL filtering, N2H2 is also supported. Unfortunately there is no software available to "decipher" your syslog messages. You need to copy the text file into a text editor and surf trough all the info using an ip addresses. You can use the following link if you are having a hard time reading your syslog messages:

http://www.cisco.com/en/US/docs/security/pix/pix63/system/message/pixemsgs.html

 

[brianinms]

Actually there is softwall to decipher your syslog messages. One such example is FireGen

http://www.eventid.net/firegen/firegenpix2.asp

 

[maravila]

bty

If you want to monitor access to certain URLs you can enable the fixup protocol http 80 command that will generate the following syslog message:


304001
Error Message %PIX-5-304001: user source_address Accessed {JAVA URL|URL}
dest_address: url.
Explanation This is an FTP/URL message. This message is logged when the specified host attempts to access the specified URL.
Recommended Action None required.