CCNP Security Firewall Cert Guide: Recording ASA Activity

• System Time: This section describes configuration of system time, both locally on the Cisco Adaptive Security Appliance and through the use of NTP.
• Managing Event and Session Logging: This section gives an overview of the security appliance logging subsystem, including event destinations, severity levels, and NetFlow support.

  NOTE

  The terms Cisco Adaptive Security Appliance, ASA, and security appliance are used interchangeably.

• Configuring Event and Session Logging: This section describes the configuration of logging on the security appliance. It covers the setting of global parameters, the creation of event lists and filters, and the details on configuring a number of event destinations.
• Verifying Event and Session Logging: This section covers commands used to verify proper functioning of logging on the security appliance.
• Troubleshooting Event and Session Logging: This section covers commands used to troubleshoot logging functionality.

Effective troubleshooting of network or device activity, from the perspective of the security appliance, requires accurate information. Many times, the best source of accurate and complete information will be various logs, if logging is properly configured to capture the necessary information. A Cisco security appliance has many potential destinations to which it can send logging information.

"Do I Know This Already?" Quiz

The "Do I Know This Already?" quiz allows you to assess whether you should read this entire chapter thoroughly or jump to the "Exam Preparation Tasks" section. If you are in doubt about your answers to these questions or your own assessment of your knowledge of the topics, read the entire chapter. Table 6-1 lists the major headings in this chapter and their corresponding "Do I Know This Already?" quiz questions. You can find the answers in Appendix A, "Answers to the 'Do I Know This Already?' Quizzes."

Table 6-1. "Do I Know This Already?" Section-to-Question Mapping

1. Which are two of the most important reasons for ensuring accurate time on the security appliance? (Choose two.)

   1. Synchronization with AAA servers
   2. Use of digital certificates
   3. Time-based Modular Policy Framework rules
   4. Time stamps in log messages

2. Where in ASDM do you configure NTP authentication and servers?

   1. Configuration > Device Setup > System Time > NTP
   2. Configuration > Device Management > System Time > NTP
   3. Configuration > Device Management > System Time > NTP > Parameters
   4. Configuration > Device Setup > System Time > NTP > Parameters

3. Consider the following command:

   ntp authentication-key 1 md5 UEB34mid@#9C

   What does this command mean?

   1. This is the first authentication key in a key ring, and the MD5 hash value is the value UEB34mid@#9C.
   2. The key number is 1, which will be sent by the NTP server in all packets. The key of UEB34mid@#9C is used to create an MD5 keyed hash value to verify the server message.
   3. The key number is 1, which is locally significant and allows the creation of multiple trusted keys per server. The key of UEB34mid@#9C is used to create an MD5 keyed hash value to verify the server message.
   4. None of these answers are correct. This is not a valid command string.

4. Consider the following command:

   ntp server 10.0.0.5 key 1 source inside prefer

   What is the meaning of the word "prefer" in this command?

   1. This NTP server is preferred over all other time sources.
   2. The security appliance prefers the use of NTP authentication key 1 over other keys in the key ring.
   3. The security appliance prefers the use of NTP authentication using key 1, but is willing to accept unauthenticated NTP messages from this server.
   4. This NTP server is preferred over other time sources of similar accuracy, but can be overridden by a more accurate time source.
   5. None of these answers are correct. This is not a valid command string.

5. What are the two major classifications of security appliance events? (Choose two.)

   1. System events
   2. Security events
   3. Network events
   4. Syslog events
   5. None of these answers are correct. This is not a valid command string.

6. Consider the following partial event message:

   Jan 5 2011 09:27:16 FIREWALL : %ASA-6-725002: Device completed ...
   

   What is the severity level of this event message?

   1. Notifications
   2. Informational
   3. Warnings
   4. Debugging
   5. Errors

7. Which version of NetFlow is supported by the security appliance?

   1. 9
   2. 2
   3. 7.2
   4. 5

8. If the internal buffer logging destination becomes full, which two locations can its contents be copied to, to ensure no loss of information?

   1. An HTTP server
   2. An FTP server
   3. Internal flash memory
   4. A TFTP server
   5. An SCP server

9. How are time stamps enabled/disabled for logging event messages to destinations?

   1. Once, globally, by navigating to Configuration > Device Management > Logging > Syslog Setup
   2. Once, globally, by navigating to Configuration > Device Management > Logging > Logging Setup
   3. Once, globally, but this can be done only from the CLI
   4. Per log destination, by navigating to Configuration > Device Management > Logging > screen for destination being configured
   5. Per log destination, but this can be done only from the CLI interface

10. You want to change the level at which message 106018 is logged to Notifications, from its default setting. The message will be sent to your syslog server destination. Which of the following is the correct command syntax?

    1. logging trap message 106018 level Notifications
    2. message 106018 syslog level Notifications
    3. logging message 106018 level Notifications
    4. logging level Notifications message 106018
    5. logging message 106018 new level Notifications

11. What is an event list? (Choose all that apply.)

    1. A grouping of messages, based on which logging subsystem generated the events in the list.
    2. A reusable group of messages, selected by a combination of event class, event severity, and separately by message IDs.
    3. A filter, used to determine which messages generated by the logging subsystem are forwarded to a particular log destination.
    4. All of these answers are correct.

12. You want to configure logging so that email messages are sent to administrators when events of maximum level Errors are generated by the system. Which of the following is the correct syntax for the command you need to use?

    1. logging smtp Errors
    2. logging trap smtp Errors
    3. logging email Errors
    4. logging trap email Errors
    5. logging mail Errors
    6. logging trap mail Errors

13. You want to verify that the security appliance is sending NetFlow v9 records to the configured NetFlow collector. Which of these items will do that?

    1. Use the show logging command and look for a non-zero number as messages logged for the NetFlow destination.
    2. Use the show logging command and look for a non-zero number as packets sent for the NetFlow destination.
    3. Use the show flow-export counters command and look for a non-zero number as messages logged.
    4. Use the show flow-export counters command and look for a non-zero number as packets sent.

14. You suspect your syslog server is not receiving all messages generated by the security appliance, possibly due to excessive logging leading to a queue overflow. What command would you use to verify your suspicions?

    1. show logging
    2. show logging queue
    3. show logging drops
    4. show logging queue drops