I'm looking to configure a syslog server for all of my cisco device logging. I've had a look at CNA and can't find any options to define a syslog server for my switches.
What's the best way to define a syslog server and the severity of the notifications? Also, i'm looking to clear all previous Syste mmessages fon my devices?
I'm trying to view the logs from a Cisco 857W router to a workstation running the Kiwi Syslog server. what I've done is the following:
Config term
Logging on
Logging source-interface BVI1
Logging Facility Local7 (or any other facility you want to allocate for this router.)
Logging [IP Address or Hostname of machine running Kiwi Syslog Server]
End
I see noting on the syslog server. Although I can see the log information on the router Also is there a command to stop the logging from generating or is this on by default.
I have configured my 2951 router to send logs to my Kiwi syslog server like below.
#logging 10.20.20.52
But I am not receiving any logs from my router, the same has configured on my asa5520 and its sending logs.
logging buffered 4096 warnings The above causes router to log all the events with severity level 4 or below in buffer.What about logging console warnings command?will the above command cause router to send log messages with severity level 4( warnings severity level) to console only or will the router send all the log messages with severity level 4 or below to console ?
View 3 Replies View RelatedHow to set up logging of commands on syslog server ? (cisco nexus 7010)
View 2 Replies View RelatedI am sending TACACS administration logging to a syslog server. When the messages show up on the syslog server, they are 5 hours ahead of the actual time. Time on the ACS is correct - local logging shows the correct time. Time on the syslog server is correct...all other devices/systems sending syslog messages to it are coming through with the correct time. why the ACS syslog messages would be 5 hours ahead?
View 3 Replies View RelatedWe have Dell M6220 blade server that server is connected to cisco 3750 switch. I am trying to configure LACP in 3750 for two port which are connected to Dell M6220 server switch. The channel-group 2 mode active commande is not taking then its showing the error protocol mismatch and if i run show int port-channel 2 command the port channel status is showing down. The Dell server switch is on simple mode. below i have attached the required details.
Switch#show int port-channel 2
Port-channel2 is down, line protocol is down (notconnect)
Hardware is EtherChannel, address is 0000.0000.0000 (bia 0000.0000.0000)
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
[code]...
This is regarding CISCO logging configuration.We palnned to implement enable logging on all the cisco nexus switchs.we are running HP arc sight in our DC this device monitor all the CISCO devices.We want to enable logging with this Arc sight device.Just I would like to know about config commands for Nexus device, what is the command to enable logs which is include "who is login & logout?, interface down information?,who was did conf t ? & every logs"
View 8 Replies View RelatedI can't seem to send config changes to our syslog server on a 2950, I'm fine with 2960's and 3750's. The Cisco 2955 is using the latest IOS c2955-i6k2l2q4-mz.121-22.EA14.bin.
Here is what I have added:
logging buffered 64000 debugging
logging console informational
logging monitor informational
[Code].....
The only sylog message I get is "Configured from console by username on vty0 (10.1.1.35)
I have installed a switch (3560) that was from another site and changed all it's config and hostname etc and it is now live, however the syslog messages still see the old hostname, what could be causing this?
View 3 Replies View RelatedI am using Solawinds syslog and trying to get our Cisco routers send syslogs to our syslog server. I followed the procedure on Configuring Cisco Devices to Use a Syslog Server from [URL] Our Cisco swtches are all sending syslog messages but not the routers. I compared the config with our access switches but can't seem to find the problem:
Sample router config:
service nagleno service padservice tcp-keepalives-inservice tcp-keepalives-outservice timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msec localtime show-timezoneservice password-encryption!hostname WWF-RT1boot-start-markerboot-end-marker!security authentication failure rate 10 logsecurity passwords min-length 8logging buffered 4096logging rate-limit all 10logging console critical!aaa new-model!!
[Code] .......
is there a command that prevents the router from sending the syslog to the server?
I just found out that one of our 10 3750's has been assigned with an IP Address that is in conflict with a PC that has been in production long before this 3750 was deployed in our environment. Good thing it is servicing devices on a separate vlan. The conflict IP Address is assigned to the default vlan of the switch so we can connect to it from the core.If I change the IP Address of the switch, will it reboot and momentarily disconnect the devices connected to it?
View 14 Replies View RelatedIt appears that there are two different types of log information generated by the WLC-5508. The stuff that can be sent directly to syslog seems to be very basic while most of the good log information is sent via snmp trap. Does this setup to log to a SIEM in a manner that gives a good security view into the wireless controller?
View 4 Replies View RelatedI am trying to log every connection (Build, deny, etc).But for some reason I don't see them sh log.
[Code]...
Recently i have upgraded the IOS of ASA5550 (in HA mode) to 8.4.2 from 8.0.5, after OS upgrade we found that the syslog from thses firewalls are not getting captured/transfered to centralised syslog server. The server is reachable from the firewalls.
View 3 Replies View RelatedIn our datacenter we have a 3750 stack with IP base image. I have enabled PBR and reloaded the switch. Show sdm prefer says i am using default template. The reason i want to use PBR is that we have 2 firewalls on the same work and want to be able to have granular control over which gateway out of the network they use but still be able to access all internal resouces accross wan and locally.
Created access list to identify traffic:
access-list 10 permit 10.2.3.59 (test workstation on vlan 3)
Created policy:
route-map TestASA permit 10
match ip address 10
set ip next-hop 10.2.0.3
Assigned policy to the user vlan3:
ip policy route-map TestASA
Results:It changed the default gateway to the above gateway but i could not access any resources on any other vlan, could not access resouces accross wan.
I found a new bug in cisco IOS 15.1(4)M3 when running EEM script with syslog event detector.If system logging performed using the "logging discriminator" and run concurrently EEM script with syslog event detector, then Cisco router crash and goes to reboot.
Cisco ISR G2 3925E.
3750 can not support multiple subnets in it's DHCP server pool config.
Is this an issue that can be fixed with a different iOS or is there a different Cisco switch that I can replace the 3750 with that will handle multiple subnets within an individual pool?
configure qos in Cisco 3750 switch.I have configured below template and applied on the vlan interface.But i am getting the hit on the access list but I am not able to get hit on the class map.
View 2 Replies View RelatedWe have a firewall service environment where logging is handled with UDP at the moment. Recently we have noticed that some messages get lost on the way to the server (Since the server doesn't seem to be under huge stress from syslog traffic). We decided to try sending the syslog via TCP. You can imagine my surprise when I enabled the "logging host <interface name> <server ip> tcp/1470" on an ASA Security context and find out that all the connections through that firewall are now being blocked. Granted, I could have checked the command reference for this specific command but I never even thought of the possibility of a logging command being able to stop all traffic on a firewall.
The TCP syslog connection failing was caused by a mismatched TCP port on the server which got corrected quickly. Even though I could now view log messages from the firewall in question in real time, the only message logged was the blocking of new connections with the following syslog message: "%ASA-3-201008: Disallowing new connections."
Here start my questions:
- New connections are supposed to be blocked when the the TCP Syslog server are not reachable. How is it possible that I am seeing the TCP syslog sent to the server and the ASA Security Context is still blocking the traffic?
- I configured the "logging permit-host down" after I found the command and it supposedly should prevent the above problem/situation from happening. Yet after issuing this command on the Security Context in question, connections were still being blocked with the same syslog message. Why is this?
- Eventually I changed the logging back to UDP. This yet again caused no change to the situation. All the customer connections were still being blocked. Why is this?
- After all the above I removed all possible logging configurations from the Security Context. This had absolutely no effect on the situation either.
- As a last measure I changed to the system context of the ASA and totally removed the syslog interface from the Security Context. This also had absolutely no effect on the situation.
At the end I was forced to save the configuration on the ASAs Flash -memory, remove the Security Context, create the SC again, attach the interfaces again and load the configuration from the flash into the Security Context. This in the end corrected the problem. Seems to me this is some sort of bug since the syslog server was receiving the syslog messages from the SC but the ASA was still blocking all new connections. Even the command "logging permit-host down" command didn't wor or changing back to UDP.
It seems the Security Context in question just simply got stuck and continued blocking all connections even though in the end it didn't have ANY logging configurations on. Seems to me that this is quite a risky configuration if you are possibly facing cutting all traffic for hundreds of customers when the syslog connection is lost or the above situation happens and isn't corrected by any of the above measures we took (like the command "logging permit-host down" which is supposed to avoid this situation altogether).
I have 3750 series with GIBICs ports I want to create 10 vlans with its sub-net and enable all vlans to access internet.
View 4 Replies View RelatedI have WS-C3750-48PS-S, i wanted to implement GLBP on this switch, Is it possible to configure GLBP on this switch?
IOS : c3750-ipservicesk9-mz.122-55.SE4.bin
Part number: WS-C3750-48PS-S
[Code].....
How to configure hsrp in my client location.They have 1 no of router and 2 no of 3750 switch.they need to configure Hsrp in switch.
View 5 Replies View RelatedMy architecture is the same as show on the link with some difference.I use the router 1841 for inetrnet connexion instead of 7200VXR, this router 1841 is connected on the catalyst 3750 port G1/0/1.I use catalyst 2960 instead of catalyst 2950 or 2948.I use ASA 5510 for conexion on remote branche(I have 5 remote site), This ASA is connected on the catalyst 3750 port G1/0/37
Result of the test:
-I can ping devices in the same Vlans
-I can ping devices in different VLANs
-I can ping all device from the catalyst 3750
I cannot ping the router 1841 or ASA 5510 from the any devices (computer)The gateway of each computer is the correpondant VLAN IP address configured on the catalyst 3750.Why I cannot ping the router 1841 or ASA 5510 from the any devices (computer)
1. How I can manage those devices, the Switch and the router? What is the BEST SOLUTION to manage this devices?
2. I want to monitor the traffic on this environment, how I can do it? How I can monitor the traffic from customer A, Customer B, and my own LAN traffic, in terms of bandwidth that has passed throught my devices? Is it possible to monitor on MY LAN, or I have to monitor from the EXTERNAL switch?
3. How I can limit the bandwidth? I was trying to configure it using access list, with policy-map, etc....and limit this on each interface. [code]
The interface does not support the specified policy configuration and/or parameter values.Assigning a policy map to the output side of an interface not supported.With I few reading, I could see that the SWITCH 3750 doesnt support this configs.My INTERNET LINK is 30 Mbps, the ports on the Switch (WS-C3750X-48P-L) are Gigabit Ethernet.How I can limit the bandwidth here? For example, How I can limit a interface to 3Mbps..I was thinking about this:
- Limit the interface to 10Mbps: speed 10
- and limit the interface with 30% of this speed: srr-queue bandwidth limit 30
Does this work for both UPLOAD and DOWNLOAD?When the packets passes that 3Mbps limitation, will they be droped?
how to configure this. I did it in the past but kind of forgot how I did it.I have a stacked 3750 (two physical switches) connecting to a 2960.
I am creating trunk ports with limited access to VLAN 300, 600, and 700.
There is two interfaces connected from the 3750's(one on each physical stack member) to the 2960.I have the physical interfaces configured exactly the same.
3750 Config:
interface Port-channel2
!
interface FastEthernet1/0/46
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1, 300,600,700
switchport mode trunk
speed 100
[code]....
Should I keep the configuration on the physical ports and not configure the Port-Channel Interfaces? Do I need to configure port-channel load balancing? Is the channel-group mode sufficient? Goal is to basically create 2 links to the 2960 to double the bandwidth and provide redundancy.
I'm trying to configure scp for secure configuration backup. I've configured the SCP server with an account and password but, I keep getting the no such file or directory error
AP-C2R1C5-3750#sh run | b arch archive path scp://mchenry:PASSWORD@172.20.22.229//C:/Program_Files/OpenSSH/Cisco_Configs/Switch_Config
username mchenry privilege 15 password 7 XXXXXXXXXXXXXXXXXXXXX
ip scp server enable
Error: %scp: /C:/Program_Files/OpenSSH/Cisco_Configs/Switch_ConfigSep-17-16-04-44.172-1: No such file or di
SWITCH#ping 172.20.22.229 Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 172.20.22.229, timeout is 2 seconds:!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 33/33/34 ms
I have a contained environment where I just want my servers all to have the same time. I want them to pull that time from my 3750. What do I have to enable on the 3750 to be the NTP clock source.
Keep in mind that the 3750 will not be getting the source from anywhere else, just my "set clock" command.
How do i go about setting up a TFTP server from laptop to Cisco ws-C3750 48P Switch, I need to pull the image off the switch and place it on an other switch that has a corrupt image, The switch which is corrupted is the same as above Cisco ws-C3750 48P.
View 1 Replies View RelatedI am facing problem while connecting my VPN server configure at UC540 device. this device is behind my ISP router. i applied port forwording of IPSEC traffice to my cisco device which configured as vpn server. now if i try to connect with my Live IP i get the following error. [code] I test if i connect using 192.168.0.116 internally it works but if i try to connect using my Live IP it trying and trying but not connect..
View 3 Replies View RelatedI have customer who has as Core Switch one Cisco Catalyst 3750 with the IOS c3750-ipbase-mz.122-35.SE5.I know that this image support DHCP Server configuration, but I like to implementate new vlans (approx 15) and I want to know if this switch support 15 DHCP Servers.
View 3 Replies View RelatedOn a csico 3750 switch I have ntp server < IP of stratum 1 Time Server> I want the swit to sync to the to time server and provide time to peers on my network. Do I have to be configured for ntp peer < IP of stratum 1 Time Server> for that to work?
View 7 Replies View RelatedI am facing a problem in implementing HSRP. My scenario is like this, I have two 3750 switches and I have a server with two NICs. I want to run HSRP in these two switches. By the way the server is connected directly with the switches. I mean each NIC to each switch.we have teamed the two NIC (Active / Standby).what configuration need to done in switches to work HSRP.
View 4 Replies View Related
