Newsgroup: it.comp.reti.cisco
Titolo: Logging on Cisco SOHO77

Hello
Well I have a static DSL with a 8ip subnet
the first ip is my gw/router cisco on .177 IP.
on IP 178 there is a firewall that PATs the 3389 on its public wan
address
to a private lan pc 192.168.0.138
the wan int of the cisco is the atm0.35
the "public" lan is the eth0
I put an ACL on the atm0.35 wich permits the 3389 inside and log
for me it is sufficient to log on the ram even if it clears on reboot.
However I have put up a syslog. Currently I log on a syslog but only if
the ATM is up or down... not the port access...
Now is the config:
Current configuration : 8911 bytes
!
! Last configuration change at 10:26:32 CET Fri Sep 15 2006 by maggiore
! NVRAM config last updated at 10:26:11 CET Fri Sep 15 2006 by maggiore
!
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime
service timestamps log datetime localtime
service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
logging buffered informationalo
no logging monitor
no logging console
enable password 7 xxxxxxxxxxxxx
!
clock timezone CET 1
ip subnet-zero
no ip source-route
ip tcp synwait-time 15
!
no ip bootp server
username maggiore SNIP
!
!
!
interface Ethernet0
 bandwidth 10000
 ip address xxxxxxxxxxx
 ip broadcast-address xxxxxxxxx
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 no cdp enable
 hold-queue 100 out
!
interface ATM0
 bandwidth 608
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 atm vc-per-vp 64
 atm ilmi-keepalive
 dsl operating-mode itu-dmt
 hold-queue 224 in
!
interface ATM0.35 point-to-point
 bandwidth 1504
 ip address xxxxxxxxxxxxx
 ip access-group 100 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 pvc 8/35
  encapsulation aal5snap
 !
!
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.35
no ip http server
!
ip access-list log-update threshold 1
logging facility syslog
logging xx.xxx.xx.xxx (ip of the syslog)
SNIP
Now focusing on the ACL regarding my ip
access-list 100 deny   tcp any host xxxxxxx.178 eq 135
access-list 100 deny   udp any host xxxxxxx.178 eq 135
access-list 100 deny   tcp any host xxxxxxx.178 range 137 139
access-list 100 deny   udp any host xxxxxxx.178 range netbios-ns
netbios-ss
access-list 100 deny   tcp any host xxxxxxx.178 eq 445
access-list 100 deny   udp any host xxxxxxx.178 eq 445
access-list 100 permit udp any eq domain host xxxxxxx.178 range 1024
5000
access-list 100 permit tcp any host 8xxxxxxx.178 eq 3389 log -> THE
ENTRY I NEED LOGGING
access-list 100 permit tcp any host xxxxxxx.178 gt 1023
access-list 100 permit tcp any host xxxxxxx.178 gt 1023 established
access-list 100 deny   tcp any lt 1023 host xxxxxxx.178 lt 1023
access-list 100 deny   udp any lt 1023 host xxxxxxx.178 lt 1023
access-list 100 permit 41 any host xxxxxxx.178
access-list 100 deny   ip any host xxxxxxx.178
etc etc etc
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
no cdp run
etc etc etc
Currently, If i do a RDP connection on that host on port 3389, I wont be
logged... Why???
-- 
Posted via Mailgate.ORG Server - 
http://www.Mailgate.ORG

 
Hi Italo,
I think the best you should be talking on comp.dcom.sys.cisco because at it.comp.reti.cisco we speak 
italian.
Anyway, try to increase the level of loggin from informational to debugging and see what you get.
Moreover try to type "show log" instead of waiting for the syslog server.
See you on comp.dcom.sys.cisco
Alex.

I have solved the problem.
I had to put log level to "debug". Informational wasnt enough
