Cisco ASR 1004 - Table 7: Auditable Events

Page 46 of 72
As noted above, the information includes at least all of the required information. Example audit
events are included below:
Additional Audit Information: As described in Column 3 of Table 7 below.
Table 7: Auditable Events
Requirement
Auditable
Events
Additional Audit
Record Contents
Sample Record
FCS_MACSEC_
EXT.1
Session
establishment
Secure Channel
Identifier (SCI)
 Session Establishment
Mar 15 2016 12:49:11.891 IST: %MKA-5-
SESSION_START: (Te1/2 : 22) MKA Session
started for RxSCI 188b.9d3c.c83f/0000,
AuditSessionID 092B033C0000000E000C08B8,
AuthMgr-Handle 45000002 Mar 15 2016
12:49:11.891 IST: MKA-EVENT: Started a new
MKA Session on interface TenGigabitEthernet1/2 for
Peer MAC 188b.9d3c.c83f with
SCI80E0.1DC6.3E7F/0016 successfully
FCS_MACSEC_
EXT.1.7
Creation of
Connectivity
Association
Connectivity
Association Key
Names
 Creation of Connectivity Association
Mar 15 2016 <Gi1/0/2 : 9> 14:38:53.326 IST:
%MKA-5-SESSION_SECURED:
(Gi1/0/2 : 9) MKA Session was secured for RxSCI
90e2.ba12.a00d/0000, AuditSessionID
000000000000000D001C2D92, CKN
24AA15376050334AE1EA9BE8A1D0894B0000000
0000000000000000000000000
FCS_MACSEC_
EXT.3.1
Creation and
update of Secure
Association Key
Creation and
update times
 For SAK (Security Association Key) creation-
Mar 15 2016 12:54:49.937 IST: MKA-EVENT
80e0.1dc6.3e7f/0016 C7000003:
Generation of new Latest SAK succeeded (Latest
AN=0, KN=1)...
 For SAK (Security Association Key) update –
Mar 15 2016 <tel:2016> 14:38:53.326 IST: %MKA-
6-SAK_REKEY: (Gi0/1/0 : 10) MKA Session is
beginning a SAK Rekey (current Latest AN/KN 0/1,
Old AN/KN
0/1) for RxSCI f4cf.e298.ccb8/000a, AuditSessionID
CKN
1000000000000000000000000000000000000000000
000000000000000000000
FCS_IPSEC_EX
T.1
Failure to
establish an
IPsec SA.
Reason for failure.
 Initiation of IPSEC session (outbound):