Lab Objective:
The focus of this lab is to understand Syslog and Simple Network Management Protocol implementation and configuration in Cisco IOS routers.
Lab Topology:
This lab requires only a single router running, at a minimum, Cisco IOS Software 12.4 Mainline. The router should have at least one Ethernet interface. The primary purpose of this lab is to reinforce configuration knowledge of the stated chapter.
|
IMPORTANT NOTE If you have multiple devices and servers / hosts in your home lab and you would like to test solutions for topics such as Syslog, SNMP and NetFlow by setting up host and viewing charts or logging information, for example, please feel free to do so. While these labs include logging to ‘supposed’ hosts, there are no SNMP or Syslog servers in the http://www.howtonetwork.net racks and so you will not be able to test the solutions in those racks. If you only have a single router, you can bring up the Ethernet interface by implementing the following configuration: ! |
Task 1
Configure local login for the Console port on the router. Next, configure two user accounts on the router. The first user account should be for user STANDARD with a password of CCNP1. The second user account should be for user ADVANCED with a password of CCNP2. User STANDARD should be assigned the lowest privilege level, while user ADVANCED should be assigned the highest privilege level. Verify and test your configuration appropriately.
Task 2
Configure the router so that all informational messages are sent to Syslog server 150.1.1.254. These messages should include user information. Verify and test your configuration using the appropriate commands.
Task 3
In the future, multiple devices will be added to the network and they will all be logging to the 150.1.1.254 host. Management has requested Syslog messages contain the actual hostname of the device, as well as the location, e.g. Dallas, TX or Atlanta, GA for easier identification. Assuming that this device resides in Dallas, TX, configure the router to include its hostname as well as the location Dallas, TX is Sylog messages. Verify your configuration.
Task 4
Management has requested that you implement SNMPv3 on the router. Configure the router for SNMPv3 using the following guidelines:
- Using a view named NOC that includes all MIB objects within the system group
- A group named SWITCH which uses no authentication and has read-only access
- A remote engine ID of 1a2b3c4d5e for host 150.1.1.254
- A user named PASS in group SWITCH using MD5 and with a password of h@rd!
Verify your configuration using the appropriate commands.
Task 5
Configure the router to send SNMP traps to host 150.1.1.254 as follows:
- Use the SNMPv3 authNoPriv Security Level and the SNMPv3 username PASS
- Send only the environmental monitor traps and send traps from Fasthernet 0/0
Verify your configuration using the appropriate commands.
Lab Validation
Task 1
The requirements of this task are straightforward and should be very well known at this level. This task is completed as follows:
| R1(config)#username STANDARD privilege 0 password CCNP1 R1(config)#username ADVANCED privilege 15 password CCNP2 R1(config)#line console 0 R1(config-line)#login local R1(config-line)#exit |
You can verify your configuration by looking at the router configuration file:
| R1#more system:running-config | section username|line username STANDARD privilege 0 password 0 CCNP1 username ADVANCED privilege 15 password 0 CCNP2 line con 0 login local line aux 0 line vty 0 4 login |
Next, test your solution by exiting an logging in first as user STANDARD:
|
R1#exitR1 con0 is now available
Press RETURN to get started.
User Access Verification Username: STANDARD |
Finally , test your solution by exiting an logging in as user ADVANCED:
| R1#exit
R1 con0 is now available
Press RETURN to get started.
User Access Verification Username: ADVANCED |
Task 2
The requirements of this task are straightforward and have been described in previous labs. The only exception is the logging of user events. In current versions of Cisco IOS Software, you can use the logging userinfo command to enable the logging of user information. This command allows for the logging of user information when the user invokes the enable privilege mode or when the user changes the privilege level. The information logged includes username, line and privileged level. This task is completed as follows:
| R1(config)#logging on R1(config)#logging trap informational R1(config)#logging host 150.1.1.254 R1(config)#logging userinfo R1(config)#exit |
Following this, assuming you are consoled in and console logging is also enabled on the router, you will see a message similar to the following printed on the console:
| *Jun 15 12:19:02.463: %SYS-5-CONFIG_I: Configured from console by ADVANCED on console *Jun 15 12:19:03.463: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 150.1.1.254 started – CLI initiated |
Notice that the output includes the username (ADVANCED) as well as the line from which the configuration was performed (Console). A similar message would also be printed if, for example, the STANDARD user navigated from user EXEC to privileged EXEC mode on R1:
| R1 con0 is now available
Press RETURN to get started.
User Access Verification Username: STANDARD |
Task 3
In most cases, when configuring logging, a source-interface is specified. This allows network administrators to determine which host sent the information – based on the IP address of the source interface. Cisco IOS Software enhances this functionality even further by allowing an identifier to be added to the beginning of all Syslog messages sent to remote hosts.
This identifier is specified using the logging origin-id string <identifier> global configuration command. The identifier can be the hostname, the IPv4 address, the IPv6 address, or any custom text. When specifying a custom text, you must use an underscore (_) if using multiple words. For example, howtonetwork_rack1, as spaces are not allowed. If you need to specify a custom string or text that will have spaces, you need to use parenthesis (brackets), for example “howtonetwork rack 1”. When using this feature, it is important to remember that the specified custom text is only sent to remote destinations. It will NOT be included for local destinations, such as the Console or local buffer, for example. This task is completed as follows:
| R1(config)#logging origin-id string “R1 – Dallas, TX” |
You can verify your configuration by looking at the device configuration:
| R1#more system:running-config | section logging logging userinfo logging origin-id string “R1 – Dallas, TX” logging 150.1.1.254 |
Task 4
Because SNMPv3 configuration is technically beyond the scope of the current CCNP course, the same example used in the SWITCH certification guide is used here. If you read the section, you would have no problem completing this task. This task is completed as follows:
| R1(config)#snmp-server view NOC system included R1(config)#snmp-server group SWITCH v3 noauth read NOC R1(config)#snmp-server engineID remote 150.1.1.254 1a2b3c4d5e R1(config)#snmp-server user PASS SWITCH v3 auth md5 h@rd! *Jun 15 12:50:36.331: Configuring snmpv3 USM user, persisting snmpEngineBoots. Please Wait… R1(config)# |
You can view configured and default SNMP views using the show snmp view command:
| R1#show snmp view NOC system – included nonvolatile active *ilmi system – included permanent active *ilmi atmForumUni – included permanent active v1default iso – included permanent active v1default internet.6.3.15 – excluded permanent active v1default internet.6.3.16 – excluded permanent active v1default internet.6.3.18 – excluded permanent active v1default ciscoMgmt.394 – excluded permanent active v1default ciscoMgmt.395 – excluded permanent active v1default ciscoMgmt.399 – excluded permanent active v1default ciscoMgmt.400 – excluded permanent active |
You can view configured groups using the show snmp group command:
| R1#show snmp group groupname: ILMI security model:v1 readview : *ilmi writeview: *ilmi notifyview: <no notifyview specified> row status: active groupname: ILMI security model:v2c groupname: SWITCH security model:v3 noauth |
Task 5
The requirements of this task are straightforward. This task is completed as follows:
| R1(config)#snmp-server host 150.1.1.254 version 3 auth PASS envmon R1(config)#snmp-server enable traps envmon R1(config)#snmp-server source-interface traps fastethernet 0/0 |
Next, verify your configuration using the show snmp commands:
| R1#show snmp Chassis: JAE08020Z7T 0 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community name supplied 0 Encoding errors 0 Number of requested variables 0 Number of altered variables 0 Get-request PDUs 0 Get-next PDUs 0 Set-request PDUs 0 Input queue packet drops (Maximum queue size 1000) 0 SNMP packets output 0 Too big errors (Maximum packet size 1500) 0 No such name errors 0 Bad values errors 0 General errors 0 Response PDUs 0 Trap PDUs SNMP logging: enabled |
To view host configuration parameters, use the show snmp host command:
| R1#show snmp host Notification host: 150.1.1.254 udp-port: 162 type: trap user: PASS security model: v3 auth |
Final Route Configurations
R1
|
R1#term len 0 Current configuration : 1249 bytes R1# |