topic Re: Cisco Anyconnect Regex for User-ID in Automation/API Discussions

Cisco Anyconnect Regex for User-ID

LCMember4723 — Thu, 30 Apr 2015 01:06:48 GMT

We're using Cisco Anyconnect version 3.1 and are having issues using the syslog user-id receiver in panos 6.1.3. The default syslog profile for cisco anyconnect 1.0 and the regex entriy doesn't correctly interpet the correct user id dhcp assigned IP address. Need help ASAP creating new or correct regex.

Apr 29 15:31:21 FEGUSLVSSLVPN1 %ASA-4-722041: TunnelGroup <DefaultWEBVPNGroup> GroupPolicy <GroupPolicy_TEST> User <johndoe> IP <1.1.1.1> No IPv6 address available for SVC connection

Apr 29 15:31:21 FEGUSLVSSLVPN1 %ASA-4-722051: Group <GroupPolicy_SWITCHADMIN> User < johndoe> IP <1.1.1.1> IPv4 Address <2.2.2.2> IPv6 address <::> assigned to session

Apr 29 15:31:21 FEGUSLVSSLVPN1 %ASA-5-722033: Group <GroupPolicy_SWITCHADMIN> User < johndoe> IP <1.1.1.1> First TCP SVC connection established for SVC session.

Apr 29 15:31:21 FEGUSLVSSLVPN1 %ASA-6-722022: Group <GroupPolicy_SWITCHADMIN> User < johndoe> IP <1.1.1.1> TCP SVC connection established without compression

Only for event containing “%ASA-4-722051:”

User should be johndoe

IP should be IPv4 Address 2.2.2.2

Re: Cisco Anyconnect Regex for User-ID

android4255 — Thu, 30 Apr 2015 19:48:52 GMT

I've been on the phone with support for the last few days and I am having the EXACT same issue. Same panos and anyconnect version. I think it has something to do with the regex setting looking at the first ip which should be public but I'm not sure. I wish I knew regex better. Someone PLEASE HELP!

Re: Cisco Anyconnect Regex for User-ID

dmaynard — Thu, 30 Apr 2015 20:44:50 GMT

Hello pnielsen,

Recommend the following setting using Field Identifier instead of Regex in your Syslog Parse Profile.

Should collect information from the logs with matching Event String:"%ASA-4-722051:" with information needed for UserID.

Only for event containing “%ASA-4-722051:”

User should be johndoe

IP should be IPv4 Address 2.2.2.2

Re: Cisco Anyconnect Regex for User-ID

LCMember4723 — Tue, 05 May 2015 23:26:23 GMT

I came to the same conclusion too. Thanks for the info!

Re: Cisco Anyconnect Regex for User-ID

TST.Support — Tue, 06 Oct 2020 07:19:44 GMT

This solution is work. Thank.