Reporting failed logins

Question

How can I report on failed login attempts through our ASA 5515's using AnyConnect?

Answer 1

Michael,
In practical terms, ASA has limited capabilities to store this kind of information.
The best way to check this is on the AAA server you're using or by filtering syslogs.
ASA itself will store counters of how many authentications took place, how many succeeded etc. on a per-server basis.
Even the local server will store some info.
Example:
ASA# show aaa-serverServer Group:    LOCALServer Protocol: Local databaseServer Address:  NoneServer port:     NoneServer status:   ACTIVE, Last transaction at 14:07:19 UTC Thu Oct 3 2013Number of pending requests              0Average round trip time                 0msNumber of authentication requests       16888Number of authorization requests        0Number of accounting requests           0Number of retransmissions               0Number of accepts                       13Number of rejects                       16875Number of challenges                    0Number of malformed responses           0Number of bad authenticators            0Number of timeouts                      0Number of unrecognized responses        0
Best place to get details are your syslogs and AAA server reports.
Syslog messages:
http://www.cisco.com/en/US/docs/security/asa/syslog-guide/logmsgs.html
M.