topic Re: Logging Router & Switches in Network Security

Logging Router & Switches

nitinnigam — Fri, 21 Feb 2020 08:17:53 GMT

Hi,

We have 20 routers and switches of different models and we want to log or audit all the changes made to these devices.

Can someone please tell me whats the best way to log everything from these devices including telent, config chagnes ....etc.

Thanks

Re: Logging Router & Switches

Richard Burts — Wed, 27 Jul 2005 15:17:30 GMT

I think that you can get pretty much what you want through the aaa accounting feature of IOS and of CatOS. I usually include these in the config of IOS routers that I configure:

aaa accounting exec default start-stop group tacacs+

this will generate an accounting record when someone accesses the router.

aaa accounting commands 15 default start-stop group tacacs+

this will generate an accounting record when someone enters a privilege level command including config changes.

The corresponding commands that I use for CatOS based switches are:

set accounting exec enable start-stop tacacs+

set accounting commands enable all stop-only tacacs+

HTH

Rick

Re: Logging Router & Switches

nhabib — Wed, 27 Jul 2005 23:24:14 GMT

Adding to the previous response, accounting is done on the ACS (Cisco Secure)

Re: Logging Router & Switches

nitinnigam — Thu, 28 Jul 2005 02:57:33 GMT

Thanks for all the help guys...