4 Replies Latest reply on Oct 11, 2016 9:09 AM by bstephens@stalwartsystems.com

    Cisco Router with Syslog events and NetFlow

    chris_hankins

      I am working on some testing as we start to implement NetFlow into our SIEM and I have a question about the proper way to configure data sources for Cisco IOS routers that would be providing syslog events and NetFlow v9. I have read through the data source configurations and see that there is an ASA NSEL* parser that is built for netflow and there is an IOS V12xxx(ASP) parser for the syslog messages. I have experimented with the ASA NSEL parser and do not seem to be able to collect netflows from the device this way only by using the generic Netflow data source model I can gather the flows from these types of routers.

       

      My question to the community is this. Is there a way to configure a single data source that will capture both the Syslog and NetFlow from an IOS device?

       

      Having to utilize a Netflow data source and an additional data source to parse the syslog seems like it would quickly eat up the device limit supported by the receiver. Eventually we would be looking to implement this type of configuration on about 300+ routers and switches and two data sources per device does not seem ideal.

       

      Our testing devices are running IOS Version: 12.4(21) and NetFlow v9 on standard ports (514 and 9993).

       

      Thanks in advance.

       

      Chris