Getting Data In
Highlighted

How to view the port status of Cisco switches and firewalls?

Path Finder

Hello guys,

I got Cisco firewalls and switches. Now we enabled syslog but I want to see when a port status goes from down to up.
Is this possible? Because I can't see any port logs in Splunk.

Greetings,

Nick

0 Karma
Highlighted

Re: How to view the port status of Cisco switches and firewalls?

Motivator

Foe switches and routers, check the Cisco Networks app and Add-on. They're available at apps.splunk.com and will give you the field extractions necessary to set up this kind of alerting or dashboard.

Cisco ASA add-on for your firewall.

Highlighted

Re: How to view the port status of Cisco switches and firewalls?

Contributor

You can also use SNMP polling to get this information in Splunk - here is a link to a couple of MIB-II Objects:

ifAdminStatus (1.3.6.1.2.1.2.2.1.7)

ifOperStatus (1.3.6.1.2.1.2.2.1.8)

http://www.cisco.com/en/US/docs/storage/san_switches/mds9000/sw/rel_2_x/fabricware/mibs/reference/gu...

Highlighted

Re: How to view the port status of Cisco switches and firewalls?

Splunk Employee
Splunk Employee

By default the syslog level on Cisco IOS and Nexus wont show router interface and switchport changes. You will need to change the logging facilities or logging level on the device itself to see this.

Refer to General Cisco Docs : http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/system_monitoring/command/referen... or relevant IOS command references. Also look at Syslog facilities on Cisco devices.

View solution in original post

Highlighted

Re: How to view the port status of Cisco switches and firewalls?

Motivator

All the commands required on the devices are also stated in the Help page of the Cisco Networks app

0 Karma