I'm running a Cisco 2600 and Raptor firewall. My initial question is: for a logging server, can I send it to a workstation behind the firewall? It seems the router wouldn't know how to send it since it isn't in the local subnet..or will the firewall handle it? (do I specify sending it through a particular adapter so it will automatically go to the firewall, or set up a host?)
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
2600 logging -proper setup?
- Thread starter digriz60
- Start date
- Thread starter
- #2
TCP wise normally syslog will listen to ports 1065 and above. UDP it normally listens to all ports. You can set it to one in particulare on most syslog programs. Not to mentoin the majority of syslog programs also listen to SNMP traps (if you care to use those as well)
As for the comand to use:
Router(config)# logging 172.16.1.1
As long as you router knows where to route traffic it should not matter where your syslog is located.
Look up logging on cisco website, get a little more information on it.
As for the comand to use:
Router(config)# logging 172.16.1.1
As long as you router knows where to route traffic it should not matter where your syslog is located.
Look up logging on cisco website, get a little more information on it.
- Thread starter
- #4
Still no dice. Not sure what I'm doing wrong. I've got logging to a box that has an external address (it's a web server). Logging trap debug. I set up Kiwi syslogd on the web server (windows 2000). Maybe I'm using this for the wrong reason, so let me give some background. I have a client who can't get to our website or send us email. Everyone else can (from the internet). For some reason, their traffic is being blocked or rejected. They can ping my router's external and internal interface, and traceroute. They can ping (after setting up a rule) my web server. When they try to get there via a browser, or send me email, it never shows up. It never shows up on my Raptor Firewall log. So I am back to looking at the router to see if logging would pick that up, since I can't confirm they're getting to my firewall. yes, I know a ping would establish THAT PROTOCOL can get there, but if their mail or http traffic is being blocked, it should at least show up on the firewall log as a rejected packet. No evidence, so I want to step back and check the router.
- Status