Re: DMCA and NAT

[John Ladwig <John.Ladwig () SO MNSCU EDU>]

Second the comment re: "insane" level of campus-border firewall logging necessary to respond to lawful requests.  We're 
over 100GB/day across our 60ish campuses.

Cisco's ASAs won't log NAT bind - setups and teardowns - unless you go to "debug" level.  We do have a few of 
noisy+useless message IDs which we don't send as well.  Dunno how much volume that saves us, though.
 
   -jml

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Dave G 
Bulanda
Sent: Tuesday, 29 November, 2011 10:44
To: The EDUCAUSE Security Constituent Group Listserv; John Ladwig
Subject: Re: [SECURITY] DMCA and NAT

Kevin,

The way that I handle the DMCA and NAT issue is that I run syslog of my border firewall in a somewhat "INSANE" level. 

Match Outside address to inside address - Take the inside address and match via NAC system and DHCP logs to client 
machine.

[ ... ]