Getting Data In

How to view the port status of Cisco switches and firewalls?

nickbijmoer
Path Finder

Hello guys,

I got Cisco firewalls and switches. Now we enabled syslog but I want to see when a port status goes from down to up.
Is this possible? Because I can't see any port logs in Splunk.

Greetings,

Nick

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

By default the syslog level on Cisco IOS and Nexus wont show router interface and switchport changes. You will need to change the logging facilities or logging level on the device itself to see this.

Refer to General Cisco Docs : http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/system_monitoring/command/referen... or relevant IOS command references. Also look at Syslog facilities on Cisco devices.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

By default the syslog level on Cisco IOS and Nexus wont show router interface and switchport changes. You will need to change the logging facilities or logging level on the device itself to see this.

Refer to General Cisco Docs : http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/system_monitoring/command/referen... or relevant IOS command references. Also look at Syslog facilities on Cisco devices.

mikaelbje
Motivator

All the commands required on the devices are also stated in the Help page of the Cisco Networks app

0 Karma

NetFlow_Logic
Contributor

You can also use SNMP polling to get this information in Splunk - here is a link to a couple of MIB-II Objects:

ifAdminStatus (1.3.6.1.2.1.2.2.1.7)

ifOperStatus (1.3.6.1.2.1.2.2.1.8)

http://www.cisco.com/en/US/docs/storage/san_switches/mds9000/sw/rel_2_x/fabricware/mibs/reference/gu...

mikaelbje
Motivator

Foe switches and routers, check the Cisco Networks app and Add-on. They're available at apps.splunk.com and will give you the field extractions necessary to set up this kind of alerting or dashboard.

Cisco ASA add-on for your firewall.

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...