Cisco Certified Expert

Enable Audit Trails and Alerts

router(config)# service timestamps log datetime router(config)# logging 10.0.0.3 router(config)# logging facility syslog router(config)# logging trap 7 router(config)# ip inspect audit-trail

©2007 Cisco Systems, In

Turn on logging and audit trail to provide a record of network access through the firewall, including illegitimate access attempts, and inbound and outbound services.

Follow this procedure to configure logging and audit trail functions: Step 1 Add the date and time to syslog and audit trail messages.

router(config)# service timestamps log datetime

Step 2 Specify the hostname or IP address of the host where you want to send syslog messages.

router(config)# logging ip-address Step 3 Configure the syslog facility in which error messages are sent.

router(config)# logging facility facility-type

Step 4 (Optional) Limit messages logged to the syslog servers based on severity. The default is level 7 (informational).

router(config)# logging trap level

Step 5 Turn on Cisco IOS classic firewall audit trail messages.

router(config)# ip inspect audit-trail

© 2007 Cisco Systems, Inc. Adaptive Threat Defense 5-79

Disabling Alerts

To disable IOS classic firewall alert messages, use the ip inspect alert-off command in global configuration mode. To enable IOS classic firewall alert messages, use the no form of this command.

Securing Networks with Cisco Routers and Switches (SNRS) v2.0

5-80

0 0