palo alto bulk add log forwarding profile to security policy rules

You can use the migration tool to do this 

After version 10.1 there is also a log forwarding for security services policy optimizer under 

Policies > Security 

Policy optimizer in the bottom left

You need to have configured logging and your log forwarding profile in advance

Select "None" to find all the rules with no logging policy applied 

click the first rule

scroll to the bottom

hold shift and click the last rule to select all

In the bottom left click "Attach log forwarding profile"

Select your profile "LOG-FWD-PROFILE"

Click ok

Commit

Info found on: 

https://live.paloaltonetworks.com/t5/general-topics/log-forwarding-profile-in-all-security-policies/td-p/205426

Some syslog event IDs related to AnyConnect on cisco ASA

302013 - built inbound connection

302014 - teardown TCP connection

725012 - Device chooses cipher for the SSL session with peer interface

725008 - ssl client propose cipher

725007 - teardown new ssl connection / terminated

725001 - starting ssl handsharek

725002 - ssl handsake completed

725003 - request to resume

113015: AAA user authentication Rejected 

716039: Group name User user IP ip Authentication: rejected

113005 - AAA user authentication rejected

See:

https://www.cisco.com/c/en/us/support/docs/security/secure-client/221880-implement-hardening-measures-for-secure.html

Also:

http://www.cisco.com/en/US/docs/security/asa/asa82/system/message/logmsgs.html#wp4776913

716001 - anyconnect when user logs on

716002 - anyconnect when user logs off

Each connection that passes through the ASA is 9 syslogs so that will be a lot of logs

Old TAC sec pod cast

https://community.cisco.com/t5/security-knowledge-base/tac-security-podcast-show-information-and-episode-listing/ta-p/3126414

General syslog tips

Text zip's up well so you can zip before sending

Knowing the time frame of the issue helps any source / destination IPs

Notepad++ / sublime are good for working with big files

For really big files we really want a linux box

For windows users you can run a VM as well or install cygwin

User grep to look for sev1 events

grep "ASA-1-" ASASYSLOG.txt

Looks for sev 6 and pipe to head 

grep "ASA-6" ASAlogs.txt | head -n 3

-v can be used to remove items from the log

grep "ASA-6" ASAlogs.txt | grep -v "ASA-6-302011" | grep -v "ASA-6-302015" | head -n 3

We can build up our command adding more -v items

grep "ASA-6" ASAlogs.txt | grep -v "ASA-6-302011" | grep -v "ASA-6-302015" | grep -v "ASA-6-305011" | head -n 3

Other linux CLI tools that are very useful

count / sed / awk / uniq / sort / bc

To remove all the charactors on the line leading up to "Mar 28",  use the sed program to find and replace that text with "nothing":

cat ASAlogs.txt | sed 's/^.*Mar 28/Mar 28/g' | head -n 4

cut can be used to display something specific from each line:

grep "ASA-6-305011" ASAlogs.txt  | cut -f 13 -d ' '

<166>Mar 28 2013 08:22:50: %ASA-6-305011: Built dynamic TCP translation from inside:10.10.103.38/63894 to outside:192.168.124.149/63894

becomes

outside:192.168.124.149/61128

Now lets say you wanted to get rid of the 'outside' text at the start of each line. Use sed to replace that text with nothing:

grep "ASA-6-305011" ASAlogs.txt  | cut -f 13 -d ' ' | sed 's/outside://g'

When connection is torn down (teardown event) there is a byte count included

You could look for the initiator and the byte count

IP and how many bytes transfer

Then sort that based on byte count

This would give you talker

Sort by IP addresses 

Use bc to sum up all the ip and sort on byte counts and see which IP was the top talker over all

You could also work on top number of connections. Look for usernames instead of IP's etc. A ddos may make a lot of connections but small amount of data transfered 

You could look at denied connections

test outbound UDP traffic from citrix netscaler

I needed a way to test outbound UDP traffic from citrix netscaler to prove traffic was working.

Normally I would use telnet for a quick TCP port check or the "nc" command but nc was not available on NetScaler and I could not install. I was able to test like so

Log into citrix netscaller

"shell" to get into CLI mode

echo -n "Test from 192.168.0.10" > /dev/udp/172.30.50.50/514

This sent UDP traffic from 192.168.0.10 (citrix) to 172.30.50.50 (logserver) on UDP port 514 (syslog)

I was able to see it arrive in my wireshark capture on 172.30.50.50

FTD syslog event list

 https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs1.html?bookSearch=true

anyconnect syslog ids for logon logoff

When user logs on: syslog# 716001

http://www.cisco.com/en/US/docs/security/asa/asa82/system/message/logmsgs.html#wp4776913

When user logs off: syslog# 716002

delete old syslog files on a schedule with kiwi syslog

Sschedule -> Clean up job

https://support.solarwinds.com/Success_Center/Kiwi_Syslog_Server/Clean_old_logs_on_a_schedule

setup syslog on cisco ASA

Syslog is UDP traffic on port 514

The ASA will send traffic on its own IP address from SRC port 514 to dst server IP and port 514

192.168.1.254.514 > 192.168.1.100.514:  udp 201

Usual config to enable
logging enable
logging timestamp
logging trap debugging

logging facility 23

logging device-id ipaddress inside system
logging host INSIDE x.x.x.x

no logging hide username

For FMC flex config drop the g for some reason "no loggin hide username"

Syslog over S2S VPN

First make sure the VPN is up and working

logging enable

logging timestamp

logging trap debugging

logging asdm debugging

logging device-id ipaddress inside

logging device-id ipaddress inside system (system  Specifies to use the cluster system IP address of the interface to present an integrated view for all units)

Logging host can differ not sure why

logging host inside 10.36.0.200

logging host outside 10.36.0.200 (some cases I had to use outside ASA v8.2)

You will get a warning (because route is to outside) but it will work

WARNING:  configured logging host interface conflicts with route table entry

You also need to have management access configured like so

management-access inside

Set route

route outside 10.36.0.200 255.255.255.255 100.100.200.200 1

Good idea to make sure you allow ssh on the outside (public IP) and inside (LAN IP) so you can SSH in and check/change settings

ssh 180.100.100.100 255.255.255.255 outside

ssh 192.168.200.200 255.255.255.255 inside

Permit host down

logging permit-hostdown

More detail

Examples:

logging host dmz1 192.168.1.5 udp 1026 format emblem

The format emblem keyword enables EMBLEM format logging for the syslog server with UDP only. The interface_name argument specifies the interface through which you access the syslog server. The syslog_ip argument specifies the IP address of the syslog server. The tcp[/ port ] or udp[/ port ] keyword and argument pair specify that the ASA and ASASM should use TCP or UDP to send syslog messages to the syslog server.

You can configure the ASA to send data to a syslog server using either UDP or TCP, but not both. The default protocol is UDP if you do not specify a protocol.

If you specify TCP, the ASA discover when the syslog server fails and as a security protection, new connections through the ASA are blocked. To allow new connections regardless of connectivity to a TCP syslog server, see Step 3. If you specify UDP, the ASA continue to allow new connections whether or not the syslog server is operational. Valid port values for either protocol are 1025 through 65535. The default UDP port is 514. The default TCP port is 1470.

logging trap debugging

Specifies which syslog messages should be sent to the syslog server. You can specify the severity level number (1 through 7) or name. For example, if you set the severity level to 3, then the ASA send syslog messages for severity levels 3, 2, and 1. You can specify a custom message list that identifies the syslog messages to send to the syslog server.

logging permit-hostdown

(Optional)  If you negate this command and syslog server goes down then traffic stops flowing

logging facility 23

(Optional) Sets the logging facility to a value other than 20, which is what most UNIX systems expect.

logging buffered

Specifies which syslog messages should be sent to the internal log buffer, which serves as a temporary storage location. New messages are appended to the end of the list. When the buffer is full, that is, when the buffer wraps, old messages are overwritten as new messages are generated, unless you configure the ASA to save the full buffer to another location. To empty the internal log buffer, enter the clear logging buffer command.

logging buffer-size 16384

Changes the size of the internal log buffer. The buffer size is 4 KB.

logging savelog latest-logfile.txt

Saves the current log buffer content to the internal flash memory.

logging asdm debugging

logging console debugging

Specifies which syslog messages should be sent to the console port.

logging monitor debugging

Specifies which syslog messages should be sent to a Telnet or SSH session.

terminal monitor

Enables logging to the current session only. If you log out and then log in again, you need to reenter this command. To disable logging to the current session, enter the terminal no monitor command.

logging standby

send logs from the standby ASA as well

logging list

More here:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/monitor_syslog.html

setting up syslog on cisco router

Send commands typed to syslog
archive
 log config
  logging enable
  notify syslog contenttype plaintext
  hidekeys

Send debugging logs to syslog
Send our origin id as our ip
Set facility to local0
Set source interfaces to gig0/0
Set logging host IP address of the syslog server
Switch logging on for all destinations
logging trap debugging
logging origin-id ip
logging facility local0
logging source-interface GigabitEthernet0/0
logging host x.x.x.x
logging on

Make sure your have routes to your syslog server
Also firewall rules, you need syslog (udp 514 open)

kiwi syslog server notes

You can setup several displays. Display 00 is default and is usually everything

Configure circular logging
Its a good idea to setup display 01 as (drop-deny)
Create a new rule call it drop/deny
Add a filter choose simple filter put in "drop" "deny"
Add the action of display and choose display 01
In the setup section go to display 01 and update the name to display 01 (drop-deny)
You can add other actions like send email etc
You can create lots of displays for VPN troubleshooting etc
Also enable the highlighting options, defaults are decent, you can edit as needed.

You can also tick an option to auto scale width to fit messages

I like this file name

E:\syslog\%IPAdd4-%DateISO.txt

Worth installing tail also. (cygwin is good)

tracking what servers are using port 25 with linux CLI tools

There was an issue with an unknown server sending out emails and getting the public IPs blacklisted, one of my colleagues came up with this line to find what that server was by searching the syslog.

grep 'Built outbound TCP connection' my-asa-log.log | grep '/25' | grep -v 'INSIDE:192.160.10.50' | awk -F " " '{print $15}' | awk -F "/" '{print $1} | sort | uniq -c


grep 'Built outbound TCP connection' my-asa-log.log
search for outbound connections in the ASA syslog file

grep '/25'
Search for connections to port 25

grep -v 'INSIDE:192.160.10.50'
Remove entires for 192.160.10.50 (the real email server)

awk -F " " '{print $15}'
Print column 15 which was

awk -F "/" '{print $1}'
I think this was the date

sort
sorts the data alpha numeric

uniq -c
Only shows one instance of an IP address and shows the count of how many times it appeared