How to view the port status of Cisco switches and firewalls?

[nickbijmoer]

Hello guys,

I got Cisco firewalls and switches. Now we enabled syslog but I want to see when a port status goes from down to up.
Is this possible? Because I can't see any port logs in Splunk.

Greetings,

Nick

[esix_splunk · Accepted solution]

By default the syslog level on Cisco IOS and Nexus wont show router interface and switchport changes. You will need to change the logging facilities or logging level on the device itself to see this.

Refer to General Cisco Docs : http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/system_monitoring/command/referen... or relevant IOS command references. Also look at Syslog facilities on Cisco devices.

[mikaelbje]

All the commands required on the devices are also stated in the Help page of the Cisco Networks app

[NetFlow_Logic]

You can also use SNMP polling to get this information in Splunk - here is a link to a couple of MIB-II Objects:

ifAdminStatus (1.3.6.1.2.1.2.2.1.7)

ifOperStatus (1.3.6.1.2.1.2.2.1.8)

http://www.cisco.com/en/US/docs/storage/san_switches/mds9000/sw/rel_2_x/fabricware/mibs/reference/gu...

[mikaelbje]

Foe switches and routers, check the Cisco Networks app and Add-on. They're available at apps.splunk.com and will give you the field extractions necessary to set up this kind of alerting or dashboard.

Cisco ASA add-on for your firewall.