Topic: Describe the use of syslog and SNMP features

Network devices, including Cisco devices, typically engage in system-logging capabilities, commonly termed syslog. System logging allows devices to report on their health and important events that might be transpiring. In Cisco networking, we commonly call syslog simply logging. These log messages can vary from the mundane to the critical. Example 21.1 shows the default logging configuration on a Cisco router.

Example 21.1 The Default Logging Configuration of a Cisco Router

Click here to view code image

R2#
R2# show logging
Syslog logging: enabled (0 messages dropped, 2 messages rate-limited,
            0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

  Console logging: level debugging, 16 messages logged, xml disabled,
                   filtering disabled
  Monitor logging: level debugging, 0 messages logged, xml disabled,
                   filtering disabled
  Buffer logging: level debugging, 16 messages logged, xml disabled,
                   filtering disabled
  Logging Exception size (8192 bytes)
  Count and timestamp logging messages: disabled
  Persistent logging: disabled

No active filter modules.

ESM: 0 messages dropped

   Trap logging: level informational, 19 message lines logged

Log Buffer (8192 bytes):

*Aug 28 15:54:39.063: %IFMGR-7-NO_IFINDEX_FILE: Unable to open nvram:/ifIndex-table No such file or directory
*Aug 28 15:54:56.991: %LINEPROTO-5-UPDOWN: Line protocol on Interface VoIP-Null0, changed state to up
*Aug 28 15:54:56.995: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Aug 28 15:54:57.003: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to up
...

Notice that, by default, logging is enabled and that syslog messages are stored in a buffer for later analysis. Specifically, notice that three forms of logging are enabled by default:

• ▸ Console logging: Console logging involves console syslog messages such as *Aug 28 15:54:56.995: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up that you see when you are connected to the device using the console port.

• ▸ Monitor logging: Monitor logging allows users who are connected remotely (using Telnet or SSH) into the device to see console messages as well.

• ▸ Buffer logging: Buffer logging stores logs in a buffer (local memory) and permits viewing of messages at a later date, as Example 21.1 demonstrates.

Notice from the sample log messages shown in Example 21.1 that syslog messages follow a specific format with fields including the following:

• ▸ A timestamp: In this case, *Aug 28 15:54:57.003:

• ▸ The component that generated the message: In this case, %LINK (technically termed the “facility”)

• ▸ A severity level: In this case, 3

• ▸ A mnemonic for the message: In this case, UPDOWN

• ▸ A description: In this case, Interface FastEthernet1/0, changed state to up

The possible severity levels for messages are very important, especially since you can filter the logging to the various destinations by using these levels. Table 21.1 shows the syslog severity levels used by Cisco equipment.

Example 21.2 shows a sample configuration involving logging on a Cisco router.

Example 21.2 A Sample Syslog Configuration on a Cisco Router

Click here to view code image

R2#
R2# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)# logging console 6
R2(config)# logging buffered 4
R2(config)# logging monitor warning
R2(config)# logging host 10.1.1.3
R2(config)# end
R2#

The commands in Example 21.2 have the following effects:

• ▸ logging console 6: Limits console syslog messages to levels 6 through 0.

• ▸ logging buffered 4: Limits buffer syslog messages to levels 4 through 0.

• ▸ logging monitor warning: Limits monitor syslog messages to levels 4 through 0; note that you can use the severity level’s shorthand or the level number.

• ▸ logging host 10.1.1.3: Sends syslog messages to a syslog server (located at 10.1.1.3) for storage.

Simple Network Management Protocol (SNMP) eases the management of network devices. Monitoring and configuration are both possible using this technology.

SNMP version 2c is excellent and has been used for many years, but it lacks security features. In fact, it uses a simple plaintext community string (password) for security protection.

SNMP version 3 addresses the security concerns present in previous versions. This version provides robust authentication, authorization, and integrity verification—if desired. With SNMP version 3, you have several options for your security settings, as shown in Table 21.2.

Topic: Explain the forwarding per-hop behavior (PHB) for QoS, such as classification, marking, queueing, congestion avoidance, policing, and shaping

There are three main approaches you can take to quality of service (QoS) in your organization:

• ▸ Best effort (BE): Using this approach, you overprovision the bandwidth in the network as you do not use any special QoS settings or tools; most Cisco devices default to a first-in, first-out (FIFO) approach to packet queueing and forwarding in the BE configuration.

• ▸ Integrated Services (IntServ): With this approach, Resource Reservation Protocol (RSVP) is used to reserve resources on devices in the path to carry important or fragile traffic forms; this approach is no longer popular as it requires special signaling protocols and requires tight integration across the entire path of the traffic (which more often than not spans several non-homogeneously administered networks).

• ▸ Differentiated Services (DiffServ): This approach is the most popular today; it begins with traffic marking and classification to identify and group traffic that must be treated in a special manner. Traffic receives special treatment in a hop-by-hop approach based on predefined and configured per-hop behaviors (PHBs).

Marking traffic for a certain QoS treatment can be done at several layers of the OSI model:

• ▸ Layer 2: Class of service (CoS)

• ▸ Layer 2.5: The Experimental Use field in MPLS

• ▸ Layer 3: Type of service (ToS) for IPv4 and traffic class for IPv6

Should a router or switch trust the markings of incoming packets and frames? Is the directly connected device marking the packets properly? Such considerations are included in device trust. Devices you are trusting become the trust boundary in the network. Any packets arriving from outside the trust boundary should have any QoS marking ignored and cleared.

QoS seeks to control several potential issues in a network experiencing congestion. Prioritization of traffic is done in order to avoid problems with packet loss, packet delay (latency), and jitter (variations in delay).

QoS is very popular in networks today because more and more networks are converged. This means they feature two or more of the following traffic forms:

• ▸ Voice: Voice over IP permits calls to occur over the same network as data traffic; no longer are special equipment and special links required for voice traffic.

• ▸ Video: Video over IP is becoming more and more popular for the transmission of video traffic.

• ▸ Data: Data traffic could include critical transactional data and scavenger class data, such as gaming or social media traffic.

Remember that with Differentiated Services, traffic is classified and marked, and then it is treated in a special manner on a hop-by-hop basis, based on the traffic’s marking. Tools for this special treatment include the following:

• ▸ Shaping tools: Shaping permits you to control the rate of traffic on a link; traffic above a specified threshold is buffered in an attempt to send it at a later time, when there is less traffic on the link.

• ▸ Policing tools: Policing is similar to shaping; with policing, however, traffic in excess of a specified rate is dropped by default.

• ▸ Congestion management tools: There are several tools in this category. Class-based weighted fair queueing (CBWFQ) seeks to prioritize traffic based on markings, while low-latency queueing (LLQ) adds to the CBWFQ system a strict priority queue (PQ) that is reserved for voice traffic in a typical implementation.

• ▸ Congestion avoidance tools: Tools in this category seek to avoid congestion altogether before it becomes an issue. Link fragmentation and interleaving (LFI) is a popular example of a congestion avoidance tool. Large packets are fragmented so that more importantly marked packets can be interwoven between the fragments. Another interesting approach is weighted random early detection (WRED). With WRED, low-priority packets are randomly dropped when interfaces start to approach a congested level, in the hopes that the traffic’s sender will notice the drop and slow down.

Topic: Using SSH and FTP/TFTP in a network

For a long time, Telnet was the method for remotely accessing a Cisco network device and applying a configuration at the command line of that device. Unfortunately, Telnet provides no security. In fact, the protocol sends the information from a local system to the remote Cisco device in plaintext. (Have you noticed by now that any time this book mentions plaintext, it is not a good thing?)

An alternative remote access protocol that is commonly used and recommended today is Secure Shell (SSH). Secure Shell takes care of secure authentication and encryption for the desired remote access.

Follow these steps to configure a Cisco device to support SSH:

1. Use the hostname command to ensure that the device has a hostname set.

2. Use the ip domain-name command to ensure that there is a domain name configured on the device.

3. Configure the required RSA key by using the command crypto key generate rsa.

4. In your VTY lines, ensure that SSH is the only supported method (instead of Telnet) by using the command transport input ssh. Take care to apply this command (or at least the transport input none command) to all the available VTY lines.

5. Use the command ip ssh version 2 to ensure that the SSH version is 2.

For decades, File Transfer Protocol (FTP) was used to move files from one location to another over private intranets or even the pubic Internet. In fact, I still use this protocol today when delivering chapters of this text to Pearson for publishing. FTP uses the reliable TCP in its operation, along with ports 20 and 21.

You might think that FTP is of no use to Cisco networking devices, and you would be partially correct. Cisco devices to this day love to use a variation of FTP for downloading new IOS images and configuration files. This variation of FTP is called Trivial File Transfer Protocol (TFTP). It has far less overhead compared to FTP as it relies on UDP in its operation. It uses port 69.

Review Questions

1. What command allows you to see the syslog configuration that is currently in place on a Cisco router?

A. show syslog

B. show logging

C. show logging enable

D. show logging detail

2. You see the syslog message *Nov 16 00:23:23.003: %SYS-6-CLOCKUPDATE: System clock has been updated from 14:20:35 EDT Sun Aug 28 2021 to 19:23:23 EST Thu Nov 15 2022, configured from console by console. What facility produced the message?

A. %SYS-6-CLOCKUPDATE

B. CLOCKUPDATE

C. %SYS

D. 6

3. What command permits you to send log messages to a device at 10.1.1.3?

A. logging 10.1.1.3

B. logging trap level 2 10.1.1.3

C. logging host 10.1.1.3

D. logging host send 7 host 10.1.1.3

4. What approach to QoS involves marking and classifying traffic?

A. IntServ

B. DiffServ

C. BE

D. RSVP

5. What improvement does SNMP version 3 offer over SNMP v2c?

A. Monitoring with no overhead

B. Increased security

C. A reduction in server calls

D. ICMP IP SLA

6. What is the term for variation in delay?

A. Shaping

B. Packet loss

C. Latency

D. Jitter

7. LLQ is a form of what type of tool in QoS?

A. Congestion management

B. Policing

C. Shaping

D. Marking

Answers to Review Questions

1. B is correct. Use the simple show logging command to verify syslog settings, as well as to view the contents of the logging buffer.

2. C is correct. The facility precedes the severity level.

3. C is correct. Use logging host 10.1.1.3.

4. B is correct. The Differentiated Services (DiffServ) approach features classification and marking as a first step.

5. B is correct. SNMP version 3 provides security enhancements over earlier versions.

6. D is correct. Jitter refers to variation in delay. Jitter is always present, but large jitter is a major problem for voice and video traffic.

7. A is correct. Examples of congestion management QoS tools are CBWFQ and LLQ.

Hands-On Lab Practice Assignment

Additional Resources

Simple Network Management Protocol (SNMP) Version 3

https://www.ajsnetworking.com/simple-network-management-protocol-snmp-version-3

Policing and Shaping

https://youtu.be/tEaLVpoayQQ

System Message Logging

https://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html