思科log的远程管理

PIX 7.0可以透过VPN发送log到syslog服务器，还可以通过Email发送log
摘录自cisco.com
http://www.cisco.com/en/US/docs/security/pix/pix63/system/message/pixemint.html#wp1020115
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00805a2e04.shtml

Other Remote Management and Monitoring Tools

In addition to the system log function, you can remotely monitor the PIX Firewall using other tools, which are described in the following topics:

•Cisco PIX Device Manager

•Cisco Secure Policy Manager

•SNMP Traps

•Telnet

Cisco PIX Device Manager

The Cisco PIX Device Manager (PDM) is a browser-based configuration tool designed to help you set up, configure, and monitor your PIX Firewall graphically, without requiring an extensive knowledge of the PIX Firewall command-line interface (CLI). PDM ships with every PIX Firewall running software Version 6.0(1) and higher. Refer to the Cisco PIX Device Manager Installation Guide for more information.

Cisco Secure Policy Manager

Cisco Secure Policy Manager (CSPM) is a security policy management system that enables you to define, distribute, enforce, and audit network-wide security policies from a central location. CSPM streamlines the tasks of managing complicated network security events, such as perimeter access control, Network Address Translation (NAT), IDS, and IPSec-based VPNs. CSPM provides system-auditing functions, including monitoring, event notification, and web-based reporting.

CSPM can receive syslog messages from the PIX Firewall and provide notifications including email, paging, and scripting for designated syslogs. CSPM also provides reports of PIX Firewall syslogs, including the top ten users and top ten websites. These reports can be provided both on-demand and by schedule. Reports can be emailed or viewed remotely from an SSL-enabled web browser.

Refer to the following websites for more information:

http://www.cisco.com/go/policymanager

http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/index.htm

SNMP Traps

The PIX Firewall events can be reported using SNMP. This feature requires loading the Cisco SYSLOG MIB and the Cisco SMI MIB onto the SNMP management station.

Telnet

You can log in to the PIX Firewall console using Telnet from an internal host and monitor system status. If IPSec is enabled, you can also access the console from an external host. You can use the debug icmp trace and debug sqlnet commands from Telnet to view ICMP (ping) traces and SQL*Net accesses.

The Telnet console session also lets you use the logging monitor and terminal monitor commands to view syslog messages, as described in the "Sending Syslog Messages to a Telnet Console Session" section.