Reporting

How to monitor cisco devices

sachinkum
New Member

Hi,

I have installed splunk server in my organization and monitoring windows server using splunk server. Now I want to monitor Network devices like cisco switch, router, firewall etc.

So please let me know how to achive this?

Regards
Sachin

Tags (1)
0 Karma

santosh_barwa
New Member

Hi Sir,

Would please help me how to integrate network and security devices in splunk post respective vendor app installed in splunk to collect logs?

This is a fresh deployment splunk enterprise security in infrastructure.

Any assistance much appreciated 🙂

0 Karma

krugger
Communicator

Seems to me the best way would be to have Cisco devices send syslog messages to Splunk.

A couple of interesting plugins you might be interested in:
Cisco Security Suite
Cisco Firewalls
Cisco Ironport Web Security Appliance

Example config for cisco device:


configure terminal
(config)# logging thesplunkserver
(config)# logging trap 5
(config)# end
show logging

Example splunk etc/apps/search/local/inputs.conf:


[udp://20001]
connection_host = ip
index = cisco_asa
sourcetype = syslog

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...