topic Re: Secure logging in Network Security

Secure logging

gaurang_pandya — Mon, 11 Mar 2019 13:34:31 GMT

I see that starting from version 8.x of ASA, an optional word "secure" has been added with logging host command. That is.,

logging host <int> <ip> <tcp/port> secure,

But has any one got it working, without using Cisco MARS. I am trying this with other end being KiwiSyslog listening on TCP and having secure tunnel using stunnel but not havening luck.

Gaurang.

Re: Secure logging

sachinraja — Fri, 22 Aug 2008 09:56:58 GMT

Is normal syslog working through your kiwi server ? Are you seeing any rejects from the server or the firewall in the log messages ? There is no explicit statement saying the secure option doesnt work with normal syslog servers ! Not much of information too on Cisco site ! It just works with TCP protocol ...

Raj

Re: Secure logging

gaurang_pandya — Sat, 23 Aug 2008 03:52:00 GMT

Yes it does work normally with Kiwi server, no info available not just with Cisco but anywhere else through googling. I dont think any one has got it working yet.

Re: Secure logging

robertson.michael — Thu, 28 Aug 2008 20:41:16 GMT

Hi Gaurang,

The reason this isn't working is that Kiwi Syslog Daemon does not support SSL/TLS connections. The 'secure' keyword requires that the syslog server support SSL/TLS, so you'll need to switch to a different server.

Hope that helps.

-Mike

Re: Secure logging

gaurang_pandya — Fri, 29 Aug 2008 09:50:16 GMT

if you read my first post, i have clearly said..for secure connection i am using stunnel, which then forwards unencrypted packets to KiwiSyslog listening in TCP port.

Re: Secure logging

Farrukh Haroon — Fri, 29 Aug 2008 13:12:49 GMT

in the logging statement on the ASA which port have u mentioned?

Is the same port listening on the stunnel application? (this is the accept port in the stunnel.conf)

If you have Hucaby's ASA book, he has detailed instructions to set this up, its not so simple. If you need further help let me know, I can summarize the steps for you.

Regards

Farrukh

Re: Secure logging

gaurang_pandya — Mon, 08 Sep 2008 16:14:18 GMT

yes, i have done right stunnel config, and right tcp/port given in ASA, it would be great if you can summarize steps or point me to url that explains this in detail.

Thanks,

Gaurang.

Re: Secure logging

Farrukh Haroon — Tue, 16 Sep 2008 18:56:40 GMT

Sorry for the late reply.

Please find attached presentation from a Cisco TAC training to configure this.

Regards

Farrukh