Cisco ASR 1002 - Page 51

Page 51 of 72
Requirement
Auditable
Events
Additional Audit
Record Contents
Sample Record
Mar 24 07:29:59.480: \%SEC_LOGIN-4-
LOGIN_FAILED: Login failed [user: admin15]
[Source: 10.21.0.101] [localport: 22] [Reason: Login
Authentication Failed] at 07:29:59 EDT Tue Mar 24
2015
FIA_X509_EXT
.1
Unsuccessful
attempt to
validate a
certificate
Session
establishment
with CA
Reason for failure
Entire packet
contents of packets
transmitted/receive
d during session
establishment.
42479: Initiator SPI : 6038B31E75BFF128 -
Responder SPI : ECB6C134F5652076 Message id: 1
42478: *Feb 5 11:10:18.749: IKEv2:(SA ID =
1):Sending Packet [To 210.1.1.1:500/From
110.1.1.1:500/VRF i0:f0]42442: *Feb 5
11:10:18.747: IKEv2:(SA ID = 1):[PKI -> IKEv2]
Getting of cert chain for the trustpoint PASSED
42441: *Feb 5 11:10:18.747: IKEv2:(SA ID =
1):[IKEv2 -> PKI] Getting cert chain for the
trustpoint rahul
42440: *Feb 5 11:10:18.747: IKEv2:(SA ID =
1):[PKI -> IKEv2] Retrieved trustpoint(s): 'rahul'
42439: *Feb 5 11:10:18.747: IKEv2:(SA ID =
1):[IKEv2 -> PKI] Retrieving trustpoint(s) from
received certificate hash(es)
42438: *Feb 5 11:10:18.747: IKEv2:(SA ID =
1):Processing IKE_SA_INIT message
42437: *Feb 5 11:10:18.747: IKEv2:(SA ID =
1):Verify SA init message
42436: *Feb 5 11:10:18.747: IKEv2:(SA ID =
1):Processing IKE_SA_INIT message
42435: SA KE N VID VID
NOTIFY(NAT_DETECTION_SOURCE_IP)
NOTIFY(NAT_DETECTION_DESTINATION_IP)
CERTREQ
NOTIFY(HTTP_CERT_LOOKUP_SUPPORTED)
Aug 3 19:10:18.621: %PKI-3-
CERTIFICATE_REVOKED: Certificate chain
validation has failed. The certificate (SN: 04) is
revoked

FMT_MOF.1(1)/
AdminAct
Modification of
the behaviour of
the TSF.
None.
Feb 17 2013 16:34:02: %PARSER-5-
CFGLOG_LOGGEDCMD: User:test_admin logged
command:logging informational