The importance of accurate time was addressed in Chapter 10. It is also important to make sure that all log messages include detailed time information. Without this information, it becomes impossible to precisely correlate various log files to determine when an incident happened. To configure Cisco routers to include detailed time information in all log messages, use the service timestamps log datetime command. Use the following options to make sure as much information as possible is captured:

To enable this detailed timestamping:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#service timestamps log datetime msec localtime show-timezone
RouterOne(config)#^Z

To see console messages, you must be logged into the console. The console is configured by default to level 5 (notifications), meaning that it only displays messages of notification level or above.

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#logging console 7
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#logging console debugging
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#no logging console
RouterOne(config)#^Z

Buffered logging keeps copies of log messages in the router’s RAM. This makes it very easy for an administrator logged into the router to display current log messages. The RAM buffer is circular. The buffer is a fixed size, and as new messages are added to the buffer, the older messages are deleted. This keeps the most recent messages in the buffer without filling up the router’s memory.

The size of each router’s logging buffer should be configured with regard to the amount of RAM on the router. These buffers should be large enough to keep useful log entries, but small enough not to use up the router’s RAM and interfere with performance. A size of 16,000 or 32,000 bytes is usually sufficient and doesnt overwhelm the router. Play with the values if you find that you need log messages kept longer.

To enable buffered logging:

The following example configures the router to use a 32,000-byte logging buffer and to log messages of level 6 (informational) and above:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#logging on
RouterOne(config)#logging buffered 32000
RouterOne(config)#logging buffered informational
RouterOne(config)#^Z

While logging is enabled to the console by default, log messages are not normally sent to the VTYs. If you are logged in through the network on a VTY and want to see log messages on your terminal, use the terminal monitor command:

The following example configures the terminal to receive level 3 (error) messages and above:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#logging monitor error
RouterOne(config)#^Z
RouterOne#terminal monitor

Note that the terminal monitor command was run not from configuration mode, but rather from privileged or enable mode.

syslog logging is the most important non-AAA method of logging. All previous logging methods print the log message to a terminal or keep the log in memory. Neither of these records the log messages long term. Long-term storage is critical for keeping audit trails and is required for analyzing logs after messages have left the terminal screen or have buffered out of memory.

Almost all Unix servers come with syslog servers configured by default. Almost all security-conscious organization have one or two central syslog servers in which all logging information is sent and recorded. These messages are sent across the network to the syslog server where the server records the message to the hard drive. Centralizing your log files in this method makes correlating log information from different routers and systems much easier.

Remember to configure your router to send all log messages to a syslog server so that messages are permanently recorded and not lost when the router runs out of memory or messages scroll off the terminal screen.

Facility.Severity                                   logfile

local6.info                                 /var/log/cisco

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#logging facility local6
RouterOne(config)#logging trap informational
RouterOne(config)#logging 13.18.10.4
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#service sequence-numbers  
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#logging rate-limit all 10
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#logging rate-limit all 10 except error
RouterOne(config)#^Z

If you run SNMP (see Chapter 8), you can use SNMP traps to log additional information. Traps are packets sent to an SNMP server when specific events occur. Such events include high temperatures, configuration changes, and down interfaces. If you are familiar with SNMP and want to enable SNMP traps on your router, you must:

The following example configures the router to send traps to the SNMP server 13.145.6.5:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#snmp-server host 13.145.6.5 public
RouterOne(config)#snmp-server enable traps 
RouterOne(config)#^Z

This example configures the router to send all possible traps to the SNMP server. You can supply additional arguments to the snmp-server enable traps command to limit the traps sent. See Cisco’s documents on SNMP traps for more information.

The following examples configure your ACL antispoofing filters to log both inbound and outbound spoofing attempts. Assuming our internal network was 130.18.0.0/16, an ingress filter that logs all spoofed packets looks like:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#access-list 115 deny ip 130.18.0.0 0.0.255.255 any log-input
RouterOne(config)#access-list 115 permit ip any any
RouterOne(config)#^Z

This filter would be placed inbound on each interface that borders an external network. Assuming this was Serial 0/0 on RouterOne, enter:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#int Serial 0/0
RouterOne(config-if)#ip access-group 115 in
RouterOne(config-if)#^Z

An egress filter that logs all attempts at sending spoofed packets out of the network would look like:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#access-list 116 permit ip 130.18.0.0 0.0.255.255 any
RouterOne(config)#access-list 116 deny ip any any log-input
RouterOne(config)#^Z

And would be applied to all outgoing interfaces:

RouterOne#config terminal         
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#int Serial 0/0
RouterOne(config-if)#ip access-group 116 out
RouterOne(config-if)#^Z

Logging router login attempts through VTYs is very important. It can give you an early indication that someone is trying to access your router without authorization. Assuming you want only the IP 130.18.5.6 to be able to access the router through VTYs, your ACL would look like:

RouterOne#config terminal         
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#access-list 117 permit ip host 130.18.5.6 any
RouterOne(config)#access-list 117 deny ip any any log-input
RouterOne(config)#^Z

You would apply it the VTY lines 0 through 4 with:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#line vty 0 4
RouterOne(config-line)#access-class 117 in
RouterOne(config-line)#^Z

Now someone from an unauthorized IP trying to access a router VTY will generate a log message. The following message is an sample log entry of an unauthorized person trying to telnet to the router:

Oct 13 21:10:44.185 EDT: %SEC-6-IPACCESSLOGP: list 120 denied 
tcp 19.8.59.41(63104) -> 0.0.0.0(23), 1 packet

Many sites also choose to log all permitted VTY access attempts in addition to blocked access ones. Since all VTY access is through TCP, you can use the ACL keyword established to log successful access attempts without overwhelming your router or syslog server. This can be done effectively if you:

This example logs both access attempts from approved IPs and access attempts from unapproved IP addresses:

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#access-list 117  permit tcp host 130.218.5.6  any established 
RouterOne(config)#access-list 117  permit tcp host 130.218.5.6  any log-input
RouterOne(config)#access-list 117  deny ip any any log-input                
RouterOne(config)#^Z

Other protocols and services such as HTTP, SNMP, ICMP, and route filtering can be logged in the same way. Just add the keyword log or log-input to the deny statements of the ACLs for each service you want to log.

There are five methods of AAA accounting—EXEC, System, Command, Connection, and Network. Here is a short description of each method:

To log the largest amount of useful information, you should turn on accounting for all five methods. Each method supports three types of logging:

Recommended initial settings for each method are shown in Table 11-3.

The rest of this section provides examples on configuring each logging method.

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#aaa accounting exec default start-stop  group tacacs+
RouterOne(config)#aaa accounting system default stop-only  group tacacs+
RouterOne(config)#aaa accounting connection default start-stop  group tacacs+
RouterOne(config)#aaa accounting network default start-stop  group tacacs+
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#aaa accounting commands 1  default stop-only  group tacacs+
RouterOne(config)#aaa accounting commands 15  default stop-only  group tacacs+
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#aaa accounting exec default start-stop  group radius
RouterOne(config)#aaa accounting system default stop-only  group radius
RouterOne(config)#aaa accounting connection default start-stop  group radius
RouterOne(config)#aaa accounting network default start-stop  group radius
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#aaa accounting commands 1  default stop-only  group radius
RouterOne(config)#aaa accounting commands 15  default stop-only  group radius
RouterOne(config)#^Z

RouterOne#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
RouterOne(config)#aaa accounting send stop-record authentication failure 
RouterOne(config)#^Z