Router is a C1720 with FW/IDS feature set 12.2(17)
On a LAN workstation I loaded and configured KIWI-syslog server.(192.168.222.61)
On the router I setup the Post Office to send syslog messages to the syslog server(my pc).
I have reloaded the router twice.
I am pretty sure(99%) the syslog server is configured properly to receive Level-0 thru Level-7 messages.
I tested this using the KIWI SysGen application from another worksatation pointing to 192.168.222.61
At this time I keep getting a syslog message every 5 seconds with basically nothing it.
The syslog server reports 720 messages per hour. Each message is the same...HEX
2004-06-07 15:35:47 Local7.Debug 192.168.222.1 <001><000>'<027><000><000><000><010><000><000><000><010><001><000>'<021><000><000><000><010><000><000><000><010><©î±<000>,<001><001>‚<026><001><000><000><000><000><004><000><000><000><001>
I setup IDS and syslog hoping to capture potential hacks.
It doesn't appear to be capturing anything but the above HEX message over..n..over.
What have I configured incorrectly?
Why does it continuously send a message every 5 seconds?
Why isn't it sending the information I am looking for?
***************************************
Router# sho run
Building configuration...
Current configuration : 4537 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service dhcp
!
hostname Router
!
logging buffered 8192 debugging
logging console emergencies
enable secret 5 xxxxxxxxxxxxxxxxxxxxx
!
memory-size iomem 25
ip subnet-zero
no ip domain-lookup
!
no ip bootp server
ip audit attack action alarm drop reset
ip audit notify log
ip audit po max-events 100
ip audit po remote hostid 10 orgid 10 rmtaddress 192.168.222.61 localaddress 192.168.222.1 port 514 preference 1 timeout 5 application logger
ip audit po local hostid 10 orgid 10
ip audit smtp spam 25
ip audit name SYSLOG.1 info list 99 action alarm
ip audit name SYSLOG.1 attack action alarm drop reset
!
!
!
!
interface FastEthernet0
ip address 192.168.222.1 255.255.255.0 secondary
ip address XX.43.155.33 255.255.255.240
ip nat inside
ip audit SYSLOG.1 in
speed auto
!
interface Serial0
no ip address
encapsulation frame-relay IETF
no fair-queue
frame-relay lmi-type ansi
!
interface Serial0.744 point-to-point
ip address XX.43.154.230 255.255.255.252
ip access-group inboundfilters in
ip access-group outboundfilters out
no ip unreachables
no ip proxy-arp
ip nat outside
frame-relay interface-dlci 744 IETF
!
no ip nat service H225
ip nat pool net-192 XX.43.155.44 XX.43.155.44 netmask 255.255.255.240
ip nat inside source list 1 pool net-192 overload
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 XX.43.154.229
no ip http server
!
!
ip access-list extended inboundfilters
!
! [deleted for forum]
!
ip access-list extended outboundfilters
!
!
! [deleted for forum]
!
!
logging trap notifications
logging source-interface FastEthernet0
logging 192.168.222.61
access-list 1 permit 192.168.222.0 0.0.0.255
access-list 99 deny 192.168.222.0 0.0.0.255
access-list 99 permit any
!
!
Router#
Router#show ip audit conf
Event notification through syslog is enabled
Event notification through Net Director is disabled
Default action(s) for info signatures is alarm
Default action(s) for attack signatures is alarm drop reset
Default threshold of recipients for spam signature is 25
PostOffice:HostID:10 OrgID:10 Msg dropped:0
:Curr Event Buf Size:100 Configured:100
Host ID:10, Organization ID:10, SYN pkts sent:3484,
ACK pkts sent:0, Heartbeat pkts sent:0, Heartbeat ACK pkts sent:0,
Duplicate ACK pkts received:0, Retransmission:0, Queued pkts:0
ID:1 Dest:192.168.222.61:514 Loc:192.168.222.1:45000 T:5 S:SYN SENT
Audit Rule Configuration
Audit name SYSLOG.1
info acl list 99 actions alarm
attack actions alarm drop reset
Router#
