topic Re: HELP! PIX & multiple syslog servers in Network Security

HELP! PIX & multiple syslog servers

titansae — Fri, 21 Feb 2020 05:54:47 GMT

Hi,

Is there a command line for PIX 515-UR v6.1 Firewall to send the syslog trap to multiple workstations (trap destinations). These destinations are on the same local subnet. If so, please provide a detail command line so I can test with. Thank you all in advance.

Re: HELP! PIX & multiple syslog servers

rrbleeker — Wed, 21 Nov 2001 15:52:05 GMT

You can use multiple 'logging host' commands to specify syslog servers.

logging host [in_if_name] ip_address [protocol/port]

Re: HELP! PIX & multiple syslog servers

titansae — Sat, 01 Dec 2001 22:18:52 GMT

I've tried the following and it's not logging to the second (.3) syslog server. Any suggestion why not? Thank you.

logging on

logging timestamp

logging trap debugging

logging history warnings

logging host inside 172.16.0.2

logging host inside 172.16.0.3

Re: HELP! PIX & multiple syslog servers

jwitherell — Sat, 01 Dec 2001 22:53:19 GMT

Try removing both, then adding just the .3 address to see if it works by itself. After you've verified that it does, add the .2 address to see if they both work that way.

Suspect you'll find that the .3 server is misconfigured somehow.

Re: HELP! PIX & multiple syslog servers

netanalyze — Sun, 02 Dec 2001 00:53:23 GMT

If your syslog server is a Non-NT box make sure you have the right facility set - Unix servers expect specific facilities...

Logging Facility 22 (23, 24 etc,)

Re: HELP! PIX & multiple syslog servers

titansae — Sun, 02 Dec 2001 03:06:46 GMT

Here are a couple of "sh" outputs. I thought they might be more helpful. I think I misunderstood between snmp trap and syslog server. I am being able to send the snmp traps to (.2) and (.3) snmp traps destinations with the configuration from below. However, I am using a trial version of sl4nt (www.netal.com) syslog server and it doesn't seem to be working. I am not getting any syslog messages. It's a windows based syslog listening on default udp port 514. Please forgive me for my lack of knowledge but "what is the difference between the snmp trap and syslog server?"

Thanks all. Happy holidays.

pixfirewall# sh conf

PIX Version 6.1(1)

logging on

logging timestamp

logging trap debugging

logging history warnings

logging host inside 172.16.0.2

logging host inside 172.16.0.3

snmp-server host inside 172.16.0.2

snmp-server host inside 172.16.0.3

no snmp-server location

no snmp-server contact

snmp-server community ~notpublic~

snmp-server enable traps

pixfirewall# sh log

Syslog logging: enabled

Timestamp logging: enabled

Standby logging: disabled

Console logging: disabled

Monitor logging: disabled

Buffer logging: disabled

Trap logging: level debugging, facility 20, 30 messages logged

Logging to inside 172.16.0.2

Logging to inside 172.16.0.3

History logging: level warnings, facility 20, 1 messages logged