How to log authentication and authorization errors on ProxySG

Products

• ASG-S500

Issue/Introduction

How to log authentication and authorization errors on ProxySG

Cause

1. Logging authentication and authorization errors via access_log format on a ProxySG.
2. Advance URL to verify authentication and authorization Errors.
3. The policy substitution used to logging authentication and authorization Errors.

Resolution

1. Navigate to Configuration > Access Logging > Formats > Edit (main) and include in the format:

x-sc-authentication-error

x-sc-authorization-error

 

x-sc-authentication-error

If authentication has failed, this is the error corresponding to the failure.

If authentication has not been attempted, the value is not_attempted.

If authentication has succeeded, the value is none

 

x-sc-authorization-error

If authentication has failed, this is the error corresponding to the failure.

If authentication has not been attempted, the value is not_attempted.

If authentication has succeeded, the value is none

2. You can use the advanced authentication URL ( Statistics > Advanced > Show Authentication Error Statistics )

3. The policy substitutions $(x-sc-authentication-error) and $(x-sc-authorization-error) can also be used to log the errors on a per-transaction basis.

Policy conditions and properties that are available include:

• authenticate.tolerate_error( )
• authorize.tolerate_error( )
• user.authentication_error=
• user.authorization_error=
• has_authorization_data=

Additional Information

Further information can be found on:

https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/proxysg/7-3/introduction/controlling-access-to-the-internet-and-intranet/about-authentication-modes/permitting-users-to-log-in-with-authentication-or-authorization-failures.html