MARS

Unanswered Question
Feb 14th, 2008
User Badges:

I'm trying to setup MARS so it can alert me when failed attemps to our cisco switches 3750. Is it possible to do it? I have configured my switches with the commands required to log, but I don't see any logs for this failed attemps.


Any idea how can I complete this task?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
hoffa2000 Fri, 02/15/2008 - 04:17
User Badges:

What exactly do you mean by "failed attempts"? Is it failed NAC authentication or failed telnet/SSH access you're looking for?

An example of telnet access logging alerts would be to setup the switches to syslog debug to the MARS and then create a rule on the MARS to look for these messages.


/Fredrik

Luis Melendrez Fri, 02/15/2008 - 08:09
User Badges:

I'm trying to log any telnet/ssh failed access made to our switches.


Let me see if I understood. I need to turn on AAA authentication and then create a rule on MARS?

Actions

This Discussion