Logging on Layer-2 network

[Wajih Rehman]

Hello, 

I am not clear about logging to remote syslog as it is not working with my setup. Please check the snaphot below and configuration I define:

Initial Configuration:

- IOU-4 was configure with VLAN-1, VLAN10 and VLAN-11 interface and IP address were defined.

- A PC was connected with IOU-2 ( XP-1) which has syslog server.

- Configuration for syslog server was defined in all the switches i.e. IOU-1, IOU-2 , IOU-3 and IOU-4/

- However, I see messages coming only from IOU-4.

Then I realized that other switches do not have any IP address and that might be causing the problem. So I created a loopback address and assigned the IP address and declared it as a source IP address for logging in all the switches.

Still not logs from the switches.

Can anyone describe what is the problem here? and how logging should be define in multi-switches environment. Thanks in advance for your help and support.

Wajih

[Richard Burts]

This is described as a layer 2 network with 3 VLANs. So what is doing routing between the VLANs? Not having inter VLAN routing could certainly cause problems such as this.

HTH

Rick

[Wajih Rehman]

Hello Richard,

I have created 3 SVI interfaces on IOU-4 and inter-vlan routing is working. i.e. I can ping from any virtual pc to other pc including XP-1 which has syslog server.

What I noticed from switch (IOU-1 or 2 or 3) , I can not ping syslog server even though I can ping from the linux pc connected on the same switch.

I have even given source IP in the same VLAN in the ping command and I expect it should work. 

@Reza,

pls find configuration attach ( in the attach file).

!
logging trap debugging
logging source-interface Loopback0
logging host 192.168.1.12                        -->  IP of XP-1 where syslog server is running

interface Loopback0
 ip address 192.168.1.1 255.255.255.0    --> Loopback IP is int he same VLAN

Ping from IOU-1:

IOU1#ping 192.168.1.12 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.12, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1 
.....
Success rate is 0 percent (0/5)

If I ping to the same IP address from Linux-Core - A ( PC connected to the same switch ) to 192.168.1.12 then it is successful.

I will try to check why IOU can not ping but I was thinking it should work...

Wajih

[Reza Sharifi · Accepted solution]

Hi,

Looking the config for IOU-1 switch you don't have any management IP address.

Assuming vlan 1 is for management as I see in IOU-4.

interface Vlan1
 ip address 192.168.1.254 255.255.255.0

You also need to create the same thing for all the other switches;

example

On IOU-1

config t

interface vlan 1

ip add 192.168.1.253. 255.255.255.0

no sh

once you create this ip, if the syslog server is in vlan 1 you should be able to ping it.

HTH

[Wajih Rehman]

Hello Reza,

Thanks it solved the problem. However, I have another quesiton why loopback 0 did not work in this case?

Thanks for your support.

Wajih

[Reza Sharifi]

Hi Wajih,

The reason the loopback did not work is because your devices are mainly layer-2 and so the loopback address does not have a way/route to talk to the syslog server. Loopback address is usually used in layer-3 devices and not so much in layer-2

HTH

[Richard Burts]

Wajih

There are at least two issues that impacted trying to use loopback 0.

- loopback 0 IP existed on an interface that is not associated with any VLAN. Therefore it would not be transported on any VLAN.

- the IP and net mask configured on the loopback over lap with the subnet of the syslog server. Therefore the switch would consider that 192.168.1.0 was locally connected and would not forward the traffic to a remote switch.

HTH

Rick

[Reza Sharifi]

Hi,

The easiest way to test to make sure each IOU can talk to the syslog server is by logging into each IOU and pinging the syslog server IP address.  If the ping is successful than each IOU (switch) can talk to the syslog server, if not you probably need to configure a management IP address on each switch. If for examle vlan 10 is your management vlan, you need to configure that vlan on all switches, create an SVI for that vlan and give it an IP address.  What type of switch are you using?

Can you post the config from one that is not working?

HTH