Remote syslog configuration

jeanSamarani_2 · ‎10-29-2010

Hi All,

I have done the syslog remote configuration on the switch. However, logs are not being received to the server and when doing capture on the firewall, we have noticed that the switch is not sending the logs to the default port UDP 514 but to random port each time ( being incremented ).

Kindly find below the logs.

Can you please advise what's wrong?

Deny udp src MPROR:10.160.124.166/40865 dst To-Falcon:10.19.28.221/33437 by access-group "

Oct 28 17:56:32 Deny udp src MPROR:10.160.124.166/33007 dst To-Falcon:10.19.28.221/33438 by access-group "

Oct 28 17:56:35 Deny udp src MPROR:10.160.124.166/32790 dst To-Falcon:10.19.28.221/33439 by access-group "

Oct 28 17:56:38 Deny udp src MPROR:10.160.124.166/37362 dst To-Falcon:10.19.28.221/33440 by access-group "

Oct 28 17:56:41 Deny udp src MPROR:10.160.124.166/35964 dst To-Falcon:10.19.28.221/33441 by access-group "

Oct 28 17:56:44 Deny udp src MPROR:10.160.124.166/33659 dst To-Falcon:10.19.28.221/33442 by access-group "

Oct 28 17:56:47 Deny udp src MPROR:10.160.124.166/33024 dst To-Falcon:10.19.28.221/33443 by access-group "

Oct 28 17:56:50 Deny udp src MPROR:10.160.124.166/36429 dst To-Falcon:10.19.28.221/33444 by access-group "

Oct 28 17:56:53 Deny udp src MPROR:10.160.124.166/38646 dst To-Falcon:10.19.28.221/33445 by access-group "

Oct 28 17:56:56 Deny udp src MPROR:10.160.124.166/37650 dst To-Falcon:10.19.28.221/33446 by access-group "

Oct 28 17:56:59 Deny udp src MPROR:10.160.124.166/34049 dst To-Falcon:10.19.28.221/33447 by access-group "

Oct 28 17:57:02 Deny udp src MPROR:10.160.124.166/39291 dst To-Falcon:10.19.28.221/33448 by access-group "

Oct 28 17:57:05 Deny udp src MPROR:10.160.124.166/33938 dst To-Falcon:10.19.28.221/33449 by access-group "

Oct 28 17:57:08 Deny udp src MPROR:10.160.124.166/42739 dst To-Falcon:10.19.28.221/33450 by access-group "

Oct 28 17:57:11 Deny udp src MPROR:10.160.124.166/33979 dst To-Falcon:10.19.28.221/33451 by access-group "

Thanks.

Jean

Joe Clarke · ‎10-29-2010

Post your logging configuration from this switch as well as the show version output.

jeanSamarani_2 · ‎10-30-2010

NPE_SWITCH#sh version

Cisco IOS Software, C3750 Software (C3750-IPBASE-M), Version 12.2(35)SE5, RELEASE SOFTWARE (fc1)

Compiled Thu 19-Jul-07 19:15 by nachen

Image text-base: 0x00003000, data-base: 0x01080000

ROM: Bootstrap program is C3750 boot loader

BOOTLDR: C3750 Boot Loader (C3750-HBOOT-M) Version 12.2(25r)SEE4, RELEASE SOFTWARE (fc1)

NPE_SWITCH uptime is 46 weeks, 4 days, 23 hours, 47 minutes

System returned to ROM by power-on

System image file is "flash:c3750-ipbase-mz.122-35.SE5/c3750-ipbase-mz.122-35.SE5.bin"

cisco WS-C3750G-24TS-1U (PowerPC405) processor (revision F0) with 118784K/12280K bytes of memory.

Processor board ID FOC1332Z2UY

Last reset from power-on

2 Virtual Ethernet interfaces

56 Gigabit Ethernet interfaces

The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address : 00:26:CA:2E:C2:80

Motherboard assembly number : 73-10219-07

Power supply part number : 341-0098-02

Motherboard serial number : FOC13311PW2

Power supply serial number : DCA132891JW

Model revision number : F0

Motherboard revision number : D0

Model number : WS-C3750G-24TS-S1U

System serial number : FOC1332Z2UY

Top Assembly Part Number : 800-26859-01

Top Assembly Revision Number : E0

Version ID : V03

CLEI Code Number : CNMWS00ARC

Hardware Board Revision Number : 0x09

Switch Ports Model SW Version SW Image

------ ----- ----- ---------- ----------

1 28 WS-C3750G-24TS-1U 12.2(35)SE5 C3750-IPBASE-M

* 2 28 WS-C3750G-24TS-1U 12.2(35)SE5 C3750-IPBASE-M

Logging Configuration :

logging source-interface Vlan668

logging 10.19.28.221

Thanks.

Joe Clarke · ‎10-31-2010

There shouldn't be any port randomization going on. The syslogs should be leaving the switch destined to udp/514. Is there any Port Address Translation between the switch and the firewall that could be accounting for this? Can you perform a packet capture close to the switch to confirm the syslog messages are being destined correctly?