Syslog Configuration.

[shahinmadambi585]

Hi,

Product : C9800-L-F-K9

IOS Version : 17.3.3 (Amsterdam) 

We want to configure syslog forwarding using TCP.
We want to enable blocking of TCP connections for syslog forwarding IF the syslog server destination is down.

Question:
We want to check if this command is supported in our WLC?
logging permit-hostdown (Command taken from Cisco ASA)

[ammahend]

That command is not on 9800, but you can set a custom port for syslog (only via cli)

loggin host <IP Address> transport <TCP/UDP> port <PortNumber>

hope this helps

[shahinmadambi585]

We know the configuration for syslog forwarding. What we want to know is whether we need a command to block TCP sessions if the syslog server at the destination is down and resume if the syslog server located at the destination is up online.

This will prevent the TCP sessions from being stuck at the source side (WLC) and eventually causing the WLC to hang.

Is there such a command for the WLC?

You may refer to this link:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/monitor_syslog.html

[marce1000]

         >....if the syslog server at the destination is down and resume if the syslog server located at the destination is up online.

 Well that's the benefit of using standard UDP based syslog (only) which is stateless and your device or neither  the receiver will be bothered if the destination is offline.

 M.

[Arshad Safrulla]

You can use the below

ip tcp synwait-time <seconds>

This defines the period of time the Cisco IOS software waits while attempting to establish a TCP connection before it times out

[shahinmadambi585]

Thank you for your suggestion.

However, we do not want to use UDP because it is not reliable as TCP.

Our problem:

If we use TCP without the logging permit-hostdown command, in the event if the destination server is down, all TCP sessions will be stuck inside the source device and will cause the source device (ASA Firewall) to hang.

We want to avoid such kind of situation and that is why we want to use the logging permit-hostdown CLI.

However, we are not sure if this command is compatible with our WLC?

My question is very simple. Could you confirm if the logging permit-hostdown can be used in the WLC please?

[marce1000]

                  >....However, we do not want to use UDP because it is not reliable as TCP.

  - On pure Inranet environments , like for instance no WAN and or VPN connections between source and destination , then UDP is as much reliable as TCP.

 M.

[Rich R · Accepted solution]

NO! 

That is a firewall security logging requirement feature - nothing to do with devices hanging.

The WLC is NOT a firewall.

If you want your connections logged with that feature they will have to be routed through an ASA firewall to do that logging.