Cisco ASA
Firewalls and network logs — Cisco
What is this product?
A firewall built on access control lists (ACLs) for allow and deny decisions; its messages carry Message IDs and syslog levels instead of words.
About the company
Cisco is a leading US networking vendor. ASA is its classic firewall, still running in a large number of existing networks.
What does an analyst do inside it?
- Reads the log message and derives its meaning from its ID.
- Follows `source_address` and `destination_address`.
- Tells a rejected connection attempt from a completed session.
- Adds a deny entry to the ACL.
Its search language
These examples are written in the syntax the product itself accepts.
- source_address: 10.20.4.19
- asa_action: Deny
The field names it uses
- source_address
- destination_address
- asa_action
- reason
- device
- user
- message_id
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Found in legacy networks and large institutions; understanding it helps because many logs in the field still use its format.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.