Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

syslog: logging specific traffic only to syslog server

remote site is accessing onsite servers and need to lock them down based on host ip's and ports.

remote site connects to onsite network thru 6509 L3. want to capture remote traffic to syslog server. (only want to capture remote site traffic, no other traffic).

in order to "see" all traffic passing

"ip any any" required to determine what servers / services remote site is accessing for now. will "lock down" acl once all servers / services are identified.

how to direct only the remote site traffic to my syslog server?

acl 130 permit ip 172.16.3.0 range 1 65535 any

thx

1 REPLY
Gold

Re: syslog: logging specific traffic only to syslog server

Assuming your remote site is using IP addresses in the 172.16.3.0 subnet with a 255.255.255.0 subnet mask, and you apply your access-list 130 to inbound traffic on the VLAN interface that services them...

...just add the word "log" at the end of your ACL 130 commands. Also, make sure you have "logging x.x.x.x" in your config, where x.x.x.x is the IP address of your syslog server. It would look like this:

access-list 130 permit tcp 172.16.3.0 0.0.0.255 range 1 65535 any log

access-list 130 permit udp 172.16.3.0 0.0.0.255 range 1 65535 any log

access-list 130 permit icmp 172.16.3.0 0.0.0.255 any log

access-list 130 permit ip 172.16.3.0 0.0.0.255 any log

logging x.x.x.x

interface VLAN 163 (assuming that's your VLAN number)

ip access-group 130 in

Any hits on these lines including port numbers will show up in the syslog. You will probably get a lot of entries at first. You may want to fine-tune the ACL as you identify known services early on, so that access to them is still permitted but you don't necessarily log messages for it.

123
Views
0
Helpful
1
Replies
CreatePlease login to create content