PIX 515 VPN Access History

[cmaass]

I have a customer who thinks someone is trying to hack into their server through their VPN on the PIX515. Is there a way to find out who has connected recently.

Thanks
Chris

 

[NetworkGhost]

How is the VPN user authenticating? Do they have a syslog server?

http://www.wr-mem.com

 

[cmaass]

They have group access setup. They use the Cisco client to connect.

My suggestion today was to setup a syslog server, but currently they do not have one.

 

[NetworkGhost]

So fi they dont have user auth setup or syslog they are pretty much SOL. I would also suggest user auth. This would at least provide from some User Accounting.

http://www.wr-mem.com

 

[cmaass]

Thanks, I had a feeling that was the case.

 

[brianinms]

If they have a Windows active directory, the easiest way to configure use auth is to install IAS on a domain controller.