Redirect syslog

[Jason Vanlandingham]

I'm practicing network monitoring and syslog. I have an all-in-one cable modem/router (leftover from before I bought my Cisco gear) that will send syslog, but only to a host on its own subnet. Is there a way I can make the router's internet facing interface forward received syslog messages to my syslog server?

Topology:

[Cable Modem]--layer3--[2821ISR]--internal layer3--[Etherswitch Module]--VLAN10--[Syslog server]

[Jon Marshall · Accepted solution]

Jason

You could try setting up a NAT rule on the 2821 so that traffic sent to the 2821 router IP that connects to the cable modem is translated to an internal IP eg.

int <x>--  connects to cable modem

ip nat outside

int <y> <-- connects to switch

ip nat inside

ip nat inside source static udp <internal IP address> 514 interface <x> 514

Can't guarantee it will work as I have never done syslog with NAT but can't see why it wouldn't.

Jon

[Jason Vanlandingham]

In this example, is <internal IP address> the IP of the syslog server or the router IP that the cable modem sends syslog to? And is interface <x> the interface the syslog traffic comes in on, or the interface it should be sent to to be sent to the syslog server?

[Jon Marshall]

Apologies I should have been clearer.

The internal IP address is the syslog server.

Interface <x> connects to the cable modem so that is the interface the syslog traffic will arrive at the router on from the cable modem.

Interface <y> is the one that is used by the router to send the traffic to the syslog.

Jon

[Jason Vanlandingham]

Thanks, that worked beautifully.

Although it took me a few goofed tries to realize the nat translation command is a global command. I should have known that, though. I set up the original translation...just a "brain fart" I guess.

[Jon Marshall]

Yes, looking at the configuration I posted I can see why you'd think that, sorry :-)

Glad to hear it's working.

Jon