topic Syslog Configuration. in Wireless

Syslog Configuration.

shahinmadambi585 — Tue, 10 May 2022 05:21:42 GMT

Hi,

Product : C9800-L-F-K9

IOS Version : 17.3.3 (Amsterdam)

We want to configure syslog forwarding using TCP.
We want to enable blocking of TCP connections for syslog forwarding IF the syslog server destination is down.

Question:
We want to check if this command is supported in our WLC?
logging permit-hostdown (Command taken from Cisco ASA)

Re: Syslog Configuration.

Ambuj M — Tue, 10 May 2022 06:39:12 GMT

That command is not on 9800, but you can set a custom port for syslog (only via cli)

loggin host <IP Address> transport <TCP/UDP> port <PortNumber>

hope this helps

Re: Syslog Configuration.

shahinmadambi585 — Tue, 10 May 2022 09:32:08 GMT

We know the configuration for syslog forwarding. What we want to know is whether we need a command to block TCP sessions if the syslog server at the destination is down and resume if the syslog server located at the destination is up online.

This will prevent the TCP sessions from being stuck at the source side (WLC) and eventually causing the WLC to hang.

Is there such a command for the WLC?

You may refer to this link:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/monitor_syslog.html

Re: Syslog Configuration.

Mark Elsen — Tue, 10 May 2022 10:20:39 GMT

>....if the syslog server at the destination is down and resume if the syslog server located at the destination is up online.

Well that's the benefit of using standard UDP based syslog (only) which is stateless and your device or neither the receiver will be bothered if the destination is offline.

Re: Syslog Configuration.

Arshad Safrulla — Tue, 10 May 2022 13:51:55 GMT

You can use the below

ip tcp synwait-time <seconds>

This defines the period of time the Cisco IOS software waits while attempting to establish a TCP connection before it times out

Re: Syslog Configuration.

shahinmadambi585 — Thu, 12 May 2022 09:53:18 GMT

Thank you for your suggestion.

However, we do not want to use UDP because it is not reliable as TCP.

Our problem:

If we use TCP without the logging permit-hostdown command, in the event if the destination server is down, all TCP sessions will be stuck inside the source device and will cause the source device (ASA Firewall) to hang.

We want to avoid such kind of situation and that is why we want to use the logging permit-hostdown CLI.

However, we are not sure if this command is compatible with our WLC?

My question is very simple. Could you confirm if the logging permit-hostdown can be used in the WLC please?

Re: Syslog Configuration.

Mark Elsen — Thu, 12 May 2022 11:33:53 GMT

>....However, we do not want to use UDP because it is not reliable as TCP.

- On pure Inranet environments , like for instance no WAN and or VPN connections between source and destination , then UDP is as much reliable as TCP.

Re: Syslog Configuration.

Rich R — Tue, 17 May 2022 15:08:54 GMT

NO!

That is a firewall security logging requirement feature - nothing to do with devices hanging.

The WLC is NOT a firewall.

If you want your connections logged with that feature they will have to be routed through an ASA firewall to do that logging.