Getting Data In

How to view the port status of Cisco switches and firewalls?

nickbijmoer
Path Finder

Hello guys,

I got Cisco firewalls and switches. Now we enabled syslog but I want to see when a port status goes from down to up.
Is this possible? Because I can't see any port logs in Splunk.

Greetings,

Nick

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

By default the syslog level on Cisco IOS and Nexus wont show router interface and switchport changes. You will need to change the logging facilities or logging level on the device itself to see this.

Refer to General Cisco Docs : http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/system_monitoring/command/referen... or relevant IOS command references. Also look at Syslog facilities on Cisco devices.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

By default the syslog level on Cisco IOS and Nexus wont show router interface and switchport changes. You will need to change the logging facilities or logging level on the device itself to see this.

Refer to General Cisco Docs : http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/system_monitoring/command/referen... or relevant IOS command references. Also look at Syslog facilities on Cisco devices.

mikaelbje
Motivator

All the commands required on the devices are also stated in the Help page of the Cisco Networks app

0 Karma

NetFlow_Logic
Contributor

You can also use SNMP polling to get this information in Splunk - here is a link to a couple of MIB-II Objects:

ifAdminStatus (1.3.6.1.2.1.2.2.1.7)

ifOperStatus (1.3.6.1.2.1.2.2.1.8)

http://www.cisco.com/en/US/docs/storage/san_switches/mds9000/sw/rel_2_x/fabricware/mibs/reference/gu...

mikaelbje
Motivator

Foe switches and routers, check the Cisco Networks app and Add-on. They're available at apps.splunk.com and will give you the field extractions necessary to set up this kind of alerting or dashboard.

Cisco ASA add-on for your firewall.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...