Getting syslog data through a tunnel in PIX-to-PIX environment

[sawyerc]

I'd like to be able to get syslog data from the remote firewall in our environment. We have pix-to-pix vpns connecting them.

It doesn't want to work for us and I'm curious if someone's figured a way for it to work.

Thanks in advance.....

[dgs127]

We have a central syslog server and manage a large number of pixes.

We also want to have the Syslog and SNMP messages run over the VPN tunnel.

I believe the problem is that the source address of the messages is the external interface ip. The external interface is not typically covered in a ACL for the VPN tunnel (normally you use the inside addresses).

I hope to work on this problem in the next little while and will post the results of the testing.

[sawyerc]

That sounds like a reasonable description to me of the problem. I've done a little testing with changing the command to reference the outside interface -- that doesn't work either. And if it did, the syslog data would probably be sent in the clear -- not good.

I have a vague memory of a thought/or I heard someone ponder on whether or not it'd be possible to build a special tunnel for that traffic.....I haven't been able to visualize a method of doing that yet.......

It is nice to know that I'm not the only one trying to do this will less than immediate results -- it means I'm not being totally stupid!! I had it when the answers are a forehead slapper when I hear them!