MonitorWare Knowledge Base

I need to monitor VPN remote access to our network. We are currently using a Cisco PIX 501 which is sending syslog messages to MonitorWare, authenticating using RADIUS (IAS) against our Windows domain.

I get 5 "interesting" events with a successful VPN session:

1) PIX event indicating establishment of a security association to the client
2) PIX event indicating establishment of a security association to the PIX
3) IAS authentication event

--if-- IAS authentication is successful user allowed access
--else-- user denied access

4) Destruction of security association to client (when client disconnects)
5) Destruction of security association to PIX (when client disconnects)

All of these are being logged successfully. However, I would like to track these as a group and write a single event upon destruction of the security association that indicates disconnect.

This would make reporting on the connections and duration much simpler. Is there anyway to do this? Perhaps using status variables?[list=][/list]

Hello,

This is just a notification that we are working on your request. We have to setup a lab in order to see if we can (especially how) achieve your goal.

Best regards,
Michael Meckelein
Adiscon

I have tried to accomplish your requirement. Also have asked development if it possible to get it to work. Unfortunately we can achieve your goal with our product line at this time. Such a feature of event correlation is planned to be integrated in MonitorWare Console. But it is not available at this time. Sorry that I have no better answer at hand.

Best regards,
Michael Meckelein
Adiscon