topic Re: Syslog configuration in Network Security

Syslog configuration

shaikh.zaid22 — Wed, 30 Jun 2021 06:18:35 GMT

guys..

what is the recommended syslog configuration if i want to send all logs to azure sentinel?

i mean do i need to include the uplinks in the command? eg below:-

logging facility syslog

logging source-interface "uplink-ports"

logging host "ip add of syslog server"

Re: Syslog configuration

balaji.bandi — Wed, 30 Jun 2021 09:16:49 GMT

Its all depends how bit network and how many devices Logs you want to sent to Azure, do you have express route to Azure or using Public Internet to sending Logs.

If this is large environment.

I would advise to setup a Local syslog server, from that syslog server push all the Logs to cloud is best option and secure.

Re: Syslog configuration

shaikh.zaid22 — Wed, 30 Jun 2021 10:01:44 GMT

Thanks Balaji

We have 4 pairs of stack switches and a core sw in vss.

we have expressroute in place.

i want to know about the command "logging source-interface "uplink-ports"

if i put an uplink interface here does all the logs will pass through it ? or i donot have to put anything?

Re: Syslog configuration

balaji.bandi — Wed, 30 Jun 2021 11:21:25 GMT

yes it uses the source interface to send Logs.

"logging source-interface "uplink-ports"

make sure that uplink(layer3 has rechability to Azure IP address). (i mean it allowed your any EDGE FW interface facing or express routing facing)

Re: Syslog configuration

shaikh.zaid22 — Thu, 01 Jul 2021 06:06:51 GMT

Thanks Balaji,

Actually i have tested the config and logs are successfully being sent to sentinel. However i included source-interface as gig1/0/1 for testing.

Now i will update it with the uplink port to send all ports and other system logs.