Cisco Logging – What Does Cisco’s Logging Source-Interface Command Do?

logging

According to Cisco documentation for logging, the logging source-interface command is optional. But if set up it specifies that

syslog packets contain the IPv4 or IPv6 address of a specific interface, regardless of which interface the packet uses to exit the router.

I am confused as to what it is doing and why it is optional. At first I thought it was to indicate what interface to send the logging information out of. However, the above documentation indicates that this is not the case. If it has nothing to do with what exit interface is being used to send the logging packets, then what is its purpose?

Best Answer

The source interface command specifies which interface IP address will be used as the source IP address of the syslog packets. The actual outgoing interface will be determined by the routing table.

Related Solutions

Fortigate Logging: Prevent Ping to Firewall Interface While Logging Implicitly Denied Traffic

For Fortigate firewalls running FortiOS 5.0 or newer, it is possible to use the CLI to specifically disable logs for accepted traffic directed to the firewall itself:

Log on to firewall using SSH, then run the following commands (assuming the firewall has a VDOM named 'root')

config vdom
edit root
config log settings
set local-in-allow disable

This has to be done on a per VDOM basis.

Once this is done, the firewall keeps logging all denied traffic, without logging accepted pings, SNMP monitoring queries etc.

Fortinet has more informationg here: http://docs-legacy.fortinet.com/fgt/handbook/cli_html/index.html#page/FortiOS%25205.0%2520CLI/config_log.17.13.html

For Fortigate firewalls running FortiOS older than 5.0, I suppose the best advice is to upgrade to 5.0 or newer and then apply the setting suggested above. It seems like the feature 'set local-in-allow disable' is not available before FortiOS 5.0.

Cisco Commands – What Does Logging Synchronous Do?

"logging synchronous" prevents every logging output from immediately interrupting your console session.

See command documentation:

"This keeps unsolicited messages and debug output from being interspersed with solicited software output and prompts."

http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_l1.html#wp1020534