Configure the Logs
To trigger log entries, select the events:
•Syn Flooding—TCP connections requests are being received faster than the device can process them.
•IP Spoofing—IP packets with apparently forged source IP addresses sent with the purpose of concealing the identity of the sender or impersonating another computing system.
•Unauthorized Login Attempt—Rejected attempt to log on to the network.
•Ping of Death—Detected a malformed or otherwise malicious ping sent to a computer. A ping is normally 32 bytes in size (or 84 bytes when the Internet Protocol [IP] header is considered); historically, many computer systems could not handle a ping packet larger than the maximum IPv4 packet size of 65,535 bytes. Sending an oversize ping might crash the target computer.
•Win Nuke—A remote, denial-of-service attack (DoS) that affects the Microsoft Windows 95, Microsoft Windows NT, and Microsoft Windows 3.1x computer operating systems.
•Deny Policies—Access has been denied based on configured policies.
•Authorized Login—An authorized user has logged into the network.
•System Error Messages—System error messages are logged.
•Allow Policies—An authorized user has logged into the network through the configured policies.
•Kernel—All system kernel messages.
•Configuration Changes—Instances when the device configuration has been modified.
•IPsec and PPTP VPN—VPN tunnel negotiation, connection, and disconnection status.
•SSL VPN—SSL VPN tunnel negotiation, connection, and disconnection status.
•Network—WAN/DMZ interface is connected or disconnected.
