Table 7: Auditable Events - Cisco ASR 1000 Series Common Criteria Operational User Guidance And Preparative Procedures

As noted above, the information includes at least all of the required information. Example audit
events are included below:
Additional Audit Information: As described in Column 3 of Table 7 below.
Requirement Auditable
FCS_MACSEC_ Session
EXT.1 establishment
FCS_MACSEC_ Creation of
EXT.1.7 Connectivity
Association
FCS_MACSEC_ Creation and
EXT.3.1 update of Secure
Association Key
FCS_IPSEC_EX Failure to
T.1 establish an
IPsec SA.

Table 7: Auditable Events

Additional Audit
Events Record Contents
Secure Channel
Identifier (SCI)
Connectivity
Association Key
Names
Creation and
update times
Reason for failure.
Sample Record

Session Establishment
Mar 15 2016 12:49:11.891 IST: %MKA-5-
SESSION_START: (Te1/2 : 22) MKA Session
started for RxSCI 188b.9d3c.c83f/0000,
AuditSessionID 092B033C0000000E000C08B8,
AuthMgr-Handle 45000002 Mar 15 2016
12:49:11.891 IST: MKA-EVENT: Started a new
MKA Session on interface TenGigabitEthernet1/2 for
Peer MAC 188b.9d3c.c83f with
SCI80E0.1DC6.3E7F/0016 successfully

Creation of Connectivity Association
Mar 15 2016 <Gi1/0/2 : 9> 14:38:53.326 IST:
%MKA-5-SESSION_SECURED:
(Gi1/0/2 : 9) MKA Session was secured for RxSCI
90e2.ba12.a00d/0000, AuditSessionID
000000000000000D001C2D92, CKN
24AA15376050334AE1EA9BE8A1D0894B0000000
0000000000000000000000000

For SAK (Security Association Key) creation-
Mar 15 2016 12:54:49.937 IST: MKA-EVENT
80e0.1dc6.3e7f/0016 C7000003:
Generation of new Latest SAK succeeded (Latest
AN=0, KN=1)...

For SAK (Security Association Key) update –
Mar 15 2016 <tel:2016> 14:38:53.326 IST: %MKA-
6-SAK_REKEY: (Gi0/1/0 : 10) MKA Session is
beginning a SAK Rekey (current Latest AN/KN 0/1,
Old AN/KN
0/1) for RxSCI f4cf.e298.ccb8/000a, AuditSessionID
CKN
1000000000000000000000000000000000000000000
000000000000000000000

Initiation of IPSEC session (outbound):
Page 46 of 72