Ironport WSA Syslog subscription

[PaulTThomas]

We are currently sending syslogs using the management interface.  Am I able to send syslog using the internal interface instead.

[Ken Stieers]

If I remeber correctly, from the WSAs point of view, its a matter of routing. So if you put in a static route to the syslog host and set the gateway to be the same as for the inside interface it should send it out that interface, assuming that the syslog host isn't on the same network as the management interface.

[PaulTThomas]

Would the static route be put on the management interface (M1).

i.e.  M1 : 192.168.2.1   P1: 192.168.2.2      Log collector 10.1.1.1

So the static route configured on M1 would be Destination 10.1.1.1 Route  192.168.2.2

[Ken Stieers]

If you want it to go out the P1 interface, I'd put the route on the P1 interface.

Presumably the more specific route should take precedence so if you put it on P1, it should use P1 for that traffic.



The fuzzy part is if the WSA has some set of defined traffic routing rules written into the code, such as "syslog is management related, so we send it using M1..."

[balaji.bandi]

As long as the syslog server able to reach the source of the interface you set to send Logs, the Log message can reach syslog with Log Subscripton.