| 3.4 |  | Configure CBAC (Task 1 and 2) |
| 3.4.1 |  | Configure alerts and audit trails |

| A useful feature of CBAC is its ability to generate alerts and audit trails. This makes monitoring and tracking pre-defined security events much more efficient and effective. The alert and audit trail process works as follows:

1. CBAC generates real-time alerts and audit trails based on events tracked by the firewall.
2. Enhanced audit trail features use Syslog to track all network transactions, while recording time stamps, source host, destination host, ports used, and the total number of transmitted bytes for advanced, session-based reporting.
3. Real-time alerts send Syslog error messages to central management consoles upon detecting suspicious activity.

Note that when using CBAC inspection rules, it is possible to configure alerts and audit trail information on a per-application protocol basis. For example, to generate audit trail information for HTTP traffic, simply specify that in the CBAC rule covering HTTP inspection.

Enabling alerts and audit trails
To disable CBAC alert messages, which are displayed on the console, use the

ip inspect alert off command in global configuration mode. To enable CBAC alert messages, use the no form of this command.

> ip inspect alert-off

> no ip inspect alert-off

To turn on CBAC audit trail messages, which are displayed on the console after each CBAC session closes, use the

ip inspect audit trail command in global configuration mode. Use the no form of this command to turn off CBAC audit trail messages.

> ip inspect audit trail

> no ip inspect audit trail

The syntax for the

ip inspect audit-trail and the ip inspect alert-off commands is shown in Figure .

No other arguments or keywords are used with either command.

| Lab Activity e-Lab Activity: Lab CBAC: Audit Trail & Alert In this activity, the student will turn on logging, identify the Syslog server, and instruct the router to create an audit trail.

| Web Links Context Based Access Control Commands: http://www.cisco.com/univercd/cc/td/ doc/product/software/ios121/121sup/ 121csum1/121cssec/ssdcbac.pdf