Cisco ISR 4000 series - Page 49

Cisco ISR 4000 Family Routers Administrator Guidance
Page 49 of 66
Requirement
Auditable Events
Additional
Audit Record
Contents
Sample Record
Login failed [user: auditperson] [Source:
0.0.0.0] [localport: 0] [Reason: Login
Authentication Failed] at 23:45:43 a Sat
Apr 25 2009
See FCS_SSH_EXT.1 for remote login
audit events.
FIA_X509_EXT.1
Unsuccessful
attempt to validate
a certificate
Session
establishment with
CA
Reason for
failure
Entire packet
contents of
packets
transmitted/rec
eived during
session
establishment.
42479: Initiator SPI :
6038B31E75BFF128 - Responder SPI :
ECB6C134F5652076 Message id: 1
42478: *Feb 5 11:10:18.749:
IKEv2:(SA ID = 1):Sending Packet [To
210.1.1.1:500/From 110.1.1.1:500/VRF
i0:f0]42442: *Feb 5 11:10:18.747:
IKEv2:(SA ID = 1):[PKI -> IKEv2]
Getting of cert chain for the trustpoint
PASSED
42441: *Feb 5 11:10:18.747:
IKEv2:(SA ID = 1):[IKEv2 -> PKI]
Getting cert chain for the trustpoint rahul
42440: *Feb 5 11:10:18.747:
IKEv2:(SA ID = 1):[PKI -> IKEv2]
Retrieved trustpoint(s): 'rahul'
42439: *Feb 5 11:10:18.747:
IKEv2:(SA ID = 1):[IKEv2 -> PKI]
Retrieving trustpoint(s) from received
certificate hash(es)
42438: *Feb 5 11:10:18.747:
IKEv2:(SA ID = 1):Processing
IKE_SA_INIT message
42437: *Feb 5 11:10:18.747:
IKEv2:(SA ID = 1):Verify SA init
message
42436: *Feb 5 11:10:18.747:
IKEv2:(SA ID = 1):Processing
IKE_SA_INIT message
42435: SA KE N VID VID
NOTIFY(NAT_DETECTION_SOURC
E_IP)
NOTIFY(NAT_DETECTION_DESTIN
ATION_IP) CERTREQ
NOTIFY(HTTP_CERT_LOOKUP_SU
PPORTED)