Cisco Secure Firewall ASA · Event 605005
ASA 605005: Someone logged in to manage the firewall
A management session on the firewall itself succeeded. On a device where a handful of people ever log in, this is one of the shortest and most useful log streams you have — small enough to read by hand, and important enough that every line should have a name you recognise.
Also written as %ASA-6-605005ASA 605005Login permitted from to for userasa successful management login
- How oftenUncommon
- Vendor calls it%ASA-6 (Informational)
- Logsyslog
What it means for you
For an analyst
This is the message that supplies the source address, which 111008 does not — join them on user and time to attribute configuration changes to a location. Two things undermine it in practice: shared local accounts, which make the username meaningless as an identity, and console logins, which are recorded with 'serial' or 'console' as the source and therefore carry no address at all. If the ASA authenticates against AAA rather than local accounts you get a real identity here, which is most of the argument for configuring AAA on network devices.
The fields that decide it
Everything else in the log line is context.
- Source address and port
- Where the session came from. This is the field 111008 lacks and the reason to keep both messages.
- Interface and destination
- Which interface the login arrived on and the ASA address it reached.
-
inside or managementExpected. Compare the source against your administrator ranges. -
outsideA management login from the internet succeeded. Whether or not it was legitimate, the exposure is the finding. - Service name
- How they connected.
-
sshThe normal path on a modern configuration. -
httpsASDM or the web management interface. -
telnetCleartext management, including the credentials. Should not be in use. -
serial or consolePhysical access at the device. No source address is recorded, so this can only be attributed by other means. - User
- The account. A shared account here tells you a session happened but not who had it, which is the practical limit of this message on many deployments.
Common questions
Why does ASA 605005 sometimes show no source address?
Because the login came in over the console or an auxiliary serial port, which the message records as 'serial' or 'console' rather than an address. Those sessions involve physical access to the device, so attributing them means looking at door access and change records rather than at network logs.
How do I tie a configuration change back to a person?
Match this message to the 111008 entries for the same user around the same time. 605005 gives you the account and the source address; 111008 gives you the commands. Neither has both. If the account is a shared local one, the source address is often the only thing that distinguishes one administrator from another, which is why AAA authentication is worth configuring.
Should I alert on ASA 605005?
On a firewall, yes — the volume is low enough that alerting on every successful management login is realistic, and the population of legitimate logins is small enough that exceptions stand out. Alert with more urgency on logins arriving on an outside interface, and on any account that is not on your list of administrators.
What is the difference between 605005 and 605004?
605005 records a permitted login and 605004 records a denied one. Watching the two together is more informative than either alone: a run of 605004s followed by a 605005 from the same source is a successful guess, and that sequence is the thing worth building a rule around.
Read next
- Usually comes after ASA 111008: An administrator ran a command on the firewall The commands run during the session this message opened. Join on user and time.
- The equivalent of ASA 710003: Something tried to manage the firewall itself A management connection refused before authentication, because the source address was not permitted.
- The equivalent of Cisco ASA 113005: VPN authentication was rejected AAA authentication being rejected, the failure that this message is the success case of.
- The equivalent of Event 4624: An account was successfully logged on The Windows equivalent of a successful logon, useful when correlating an administrator's activity across devices.
Vendor documentation
Last reviewed 6 September 2026