Create a Remote Log Source - Cisco ISR

Topics Discussed

To obtain Log Relay and to configure your account for remote log collection, you must have the following Nexus permissions added to your account: 

• Write Virtual Machine

• Delete Log Management

• Read Log Endpoints

• Read Log Relays

• Write Log Relays

• Delete Log Relays

Note: These permissions are also applicable if you're using the legacy Armor Management Portal (AMP)

You can use this document to send Cisco Integrated Services Router (ISR) logs to Armor's Security Information & Event Management (SIEM).

This document only applies to:

• Cisco Integrated Services Router (ISR) (IOS)

Pre-Deployment Considerations

To create a remote Log Relay, you must already have:

• A Log Relay server on your account

  • To learn how to add Log Relay to your account, see Obtain Log Relay for Remote Log Collection

• Configured the system clock

Update Your Cisco ISR Device

1. Log into your Cisco ISR device.

2. Access the privileged EXEC mode:

   BASH

   hostname> enable

3. Access the global configuration mode:

   BASH

   hostname# configure terminal

4. Enable logging:

   BASH

   hostname(config)# logging on

5. Configure the global logging settings:

   BASH

   hostname(config)# no logging console
   hostname(config)# logging trap warning
   hostname(config)# logging origin-id hostname

6. Configure the logs to be sent to a designated Armor Log Relay device:

   BASH

   hostname(config)# logging source-interface <interface>
   hostname(config)# logging host <ipaddress> transport <protocol> port <port> 

   

   • In <interface>, enter the name of the Cisco ISR interface, such as GigabitEthernet 1.

   • In <ipaddress>, enter the IP address of the designated Armor Log Relay device.

     • In Nexus, in the left nav, hover over Infrastructure, then click Compute and Virtual Machine.

     • On the legacy Armor Management Portal (AMP), to locate your IP address in the left-side navigation, click Infrastructure, click Virtual Machines, and then review the Primary IP column for the corresponding virtual machine.

   • For <protocol> and <port>,

     • For UDP, enter transport udp port 10117.

       • Armor recommends that you use UDP.

     • For TCP, enter transport tcp port 10117.

7. Exit the configuration:

   BASH

   hostname(config)# exit

8. Save the changes:

   BASH

   hostname# write memory

9. Review the logging configuration:

   BASH

   hostname# show run all logging
   logging enable
   logging timestamp
   logging hide username
   logging buffer-size 4096
   logging asdm-buffer-size 100
   logging buffered warnings
   logging trap warnings
   logging asdm warnings
   logging device-id hostname
   logging host inside 100.64.0.10 17/5140
   logging flash-minimum-free 3076
   logging flash-maximum-allocation 1024

   

   If present, logging standby enables logging on a standby unit with failover enabled. As a result, this option causes increases traffic on the syslog server.

Troubleshooting

Verify that logs are formatted correctly, similar to the following example:

TEXT

May 22 2019 16:11:55 asav-984 : %ASA-4-411004: Interface Management0/0, changed state to administratively down