Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

Bronze

ASA generated syslog sent over site-to-site tunnel

I have a site-to-site tunnel terminated on an ASA 5520. I have syslog logging to an internal server, and I have setup a syslog server on the other side of the tunnel. I have created my acls for interesting traffic and I cannot get the ASA to send the self-generated syslog messages across the tunnel. Any ideas?

4 REPLIES
Green

Re: ASA generated syslog sent over site-to-site tunnel

Here is the document to accomplish this with Pix 6 which should help with ASA 7.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094469.shtml

What device is the other end of the tunnel? Do you want to post the configs?

Bronze

Re: ASA generated syslog sent over site-to-site tunnel

The problem I am having is not from passthru, it is from device origin going across the tunnel. I have provided a quick visio to help explain this request.

Cisco Employee

Re: ASA generated syslog sent over site-to-site tunnel

JPEG would be helpful, I do not have visio.

Also, can you please send me the output of sh logging from the ASA which needs to send the syslog to the remote side.

What is the IP address of the remote syslog server?

What does the encryption access-list look like.

Thanks

Gilbert

Green

Re: ASA generated syslog sent over site-to-site tunnel

sean, yes this is exactly as I understood from your first post.

In the .doc I referenced, the remote pix is syslogging to a server across the vpn tunnel. As long as the traffic from the outside interface of the remote ASA and the local syslog server are defined as interesting traffic in the vpn and the logging is properly configured at the remote ASA, there should be no problem. I do this today from serveral remote pixes. The source address of the interesting traffic from the remote ASA would be the outside interface address.

164
Views
0
Helpful
4
Replies