Allowing syslog thru IPsec Tunnel to central site

[greggm]

I have a Cisco 831 VPN router configured as a remote office site-to-site VPN tunnel. The outside interface of the 831 is not a static IP address, it's dynamic. I would like to have my syslogs from the Cisco 831 send to a syslog server that is at my central site. Does anyone know how to allow the 831 to send it's syslogs over the Internet VPN tunnel to a syslog server at the central site?

[Richard Burts]

While I have not done quite what you are asking on an 831 router I have done pretty similar things. And I believe it should not be difficult for you to do.

On the 831 specify logging to the remote syslog server using the logging command and specify the address of the remote syslog server.

You may want to use the logging source-interface to specify that log messages will have a source address of the inside interface (or loopback) and be consistent rather than being sourced from the outside interface which changes.

You do want to be sure that the address of the remote syslog server is reachable through the VPN tunnel. And you do want to be sure that the access list that defines interesting traffic for the VPN does permit your syslog traffic.

If you do those things I think it should work ok.

HTH

Rick

[PJWHITBY]

Hi Rick,

sorry for gatecrashing this thread, but it is very close to the issue I have.

I can get the logging stuff to work, but I cant get the TFTP traffic to pass across the VPN tunnel to a LMS server behind the PIX.

Laptop = Cisco 837 = VPN Tunnel = PIX 515 = LMS Server

How can I pass TFTP traffic from my Cisco 837 to my Cisco LMS Server.

Thanks

Paul

[PJWHITBY]

found the answer

ip tftp source-interface

Thanks anyway

[greggm]

That did it!!.. Thank you.

[riju]

What will happen when the VPN connection goes down for some reason and you need to check the remote-site log?

[greggm]

We log both local and remote. Plus we have a secondary path to the remote site.

[Richard Burts]

I think the question you ask is very similar to the question of what do you do when a remote site is connected by T1 and the T1 goes down. Whatever you would to check remote site logs for the remote connected by T1 and the T1 is down would probably be the same thing that you would do for a remote site connected by VPN when the VPN goes down.

HTH

Rick