topic Re: Auditing changes in FW in Firewall and Security Management

Auditing changes in FW

Matlu — Tue, 23 Sep 2025 22:54:10 GMT

Hello, Mates

Is it possible to “observe” all the changes made by an administrator from the CLI of a FW?

For example, if an administrator changes a route, edits an interface, adds a new interface, configures SNMPv2, configures OSPF... all this from the CLI of a FW...

Is it possible to review this activity performed by an administrator in the logs? Or is it stored somewhere else on the device?

Thanks for your comments.

Re: Auditing changes in FW

the_rock — Tue, 23 Sep 2025 22:56:26 GMT

Hey bro,

Smart console changes would be via audit logs, but something like what you described probably either smart event, or /var/log/audit dir.

Andy

Re: Auditing changes in FW

the_rock — Tue, 23 Sep 2025 23:15:37 GMT

On a second thought bro, I know our company uses syslog server for these things, when say someone logs into the firewall, we do get an alert about it.

Andy

Re: Auditing changes in FW

Chris_Atkinson — Tue, 23 Sep 2025 23:16:33 GMT

Otherwise you would check /var/log/messages

Re: Auditing changes in FW

Matlu — Tue, 23 Sep 2025 23:38:01 GMT

Hi, @Chris_Atkinson

Does this configuration shown in your image also apply when changes are made via CLI on a firewall?

If a change is successful, for example when you “delete” several VLANs, should we be able to see these changes in the SmartConsole Audit Logs?

Re: Auditing changes in FW

the_rock — Tue, 23 Sep 2025 23:44:07 GMT

Hey brother...keep in mind, those changes will NOT show up in smart console audit logs, because thats ONLY for changes made in smart console by default. However, you can make it work the way @Chris_Atkinson posted, you just need to add mgmt server in remote system logging tab. Im sure you know that by default, fw logs will be sent to the management, but not ones you are referring to, unless you set this up first.

I had done that before in the lab and was fine.

Andy

Re: Auditing changes in FW

emmap — Wed, 24 Sep 2025 02:08:04 GMT

The audit logs are explicitly for any changed made by CLI on the system. So yes. We recommend you send them to syslog and then configure central syslog server to store them all in one place, so save you having to trawl the messages files on the systems and hope the entries you want haven't rotated away.

Re: Auditing changes in FW

Henrik_Noerr1 — Wed, 24 Sep 2025 06:18:55 GMT

You need to implement sk99134 or you will not know what your privileged users are doing

/Henrik