Monitoring Cisco L3 Switch Devices

TOS Aurora monitors layer-3 switch devices for policy revision changes. For TOS Aurora to show full accountability details (who made the policy changes and when the changes were made), you must also configure the device to send syslogs.

To see which TOS features are supported for your device, review the feature support table.

Prerequisites

Make sure that the device user account that you use for SecureTrack monitoring has permission to run these commands:

  • Retrieve revision:

    terminal no exec prompt timestamp
    (use one of these commands) show running-config OR show configuration OR show startup-config
    show ip route connected
    show ip route static
    show clock
    show version
    show access-lists

  • Retrieve dynamic topology:

    show ip vrf detail

    For each VRF run:

    show ip route vrf <vrf name>
    show ip interface
    show mpls interface detail
    show ip bgp | inc ID

    If BGP is used, run:

    show ip bgp neighbors | inc BGP
    show ip bgp vpnv4 all labels
    show standby

Recommendations

  • TOS Aurora and the monitored devices must be synchronized with the correct date and time, either manually or automatically. We recommend that you also configure the devices to resolve DNS queries.

Add a Device

  1. Select Cisco > L3 Switch:

    Add Cisco

  2. Configure the device settings:

    • Name for Display

    • Domain: Available only if you have configured your system for managing multi-domains and All Domains is currently selected. Select the domain to which to add the device. The Domain can only be entered when adding a device; to change the Domain, you must migrate the device.

    • Get revisions from: One of the following:

      • IP Address: Revisions are retrieved automatically
      • Offline File: (If available) Revisions are manually uploaded to SecureTrack for Offline Analysis

    • ST server: In a distributed deployment, select which TOS Aurora cluster monitors this device (not shown in image)

    • L3 Switch Operating system: IOS or IOS-XE
    • Collect counters for rule usage analysis: Required for Rule Usage reports
    • Enable Topology: Collects routing information for building the network Interactive Map.
      Topology options for Advanced management mode are configured when you import managed devices.
    • If the device uses dynamic addressing (such as DHCP) or dynamic routing protocols (such as OSPF), also select Collect dynamic topology information.

    Click Next.

  3. Configure the SecureTrack connection to the Cisco device, according to the parameters required by the device:

    • Enter the authentication details needed to connect to the Cisco device.

      • Username and Password: The device username and password
      • Enable Password: If your device requires the Enable password, select this option and enter the password to give SecureTrack elevated privileges on the device
    • Select whether to use SSH (preferred) or Telnet: The device can be configured to use either SSH version 1 or 2
    • To use default settings (recommended in most cases), leave the Port number and both Override options clear.
    • If SecureTrack is configured to automatically replace the SSH host key when a new SSH host key is detected for a device, you can Override SSH host key settings to prevent the host key from being replaced for this device.

      You can then set SecureTrack to Replace SSH host key automatically for this specific device.

      Warning: Automatic replacement of the SSH host key can expose your server to security risks and is not recommended.

    • Override SSH Version: Select this option to force the device to use SSH-1 or SSH-2
    • Override Cipher: Select this option to force the device to use DES or 3DES encryption
  4. Click Next.

  5. In Monitoring Settings, do one of the following:

    • To use real-time monitoring and timing settings from the Timing page, select Default.

    Otherwise, select Custom and configure the monitoring mode and settings.

    Real-Time Monitoring: Applies only if syslogs Sending Additional Information using Syslog) are configured. Select Custom settings and configure:

    • 'Install policy' interval: When two or more Install Policy events for the same policy occur within this time interval, SecureTrack combines the events into a single Install Policy revision (Default: 60 seconds)

    • Automatic fetch frequency: Frequency (in minutes) for automatic fetch

    • Periodic Polling, select Custom settings and configure the Polling frequency: How often TOS Aurora fetches the configuration from each device.

      If you select 1 day, you can then select the exact time (hour and minute) for the daily polling.

    Click Next. 

  6. Save the configuration.

The Cisco device now appears in the Monitored Devices tree.

Configure a Monitored Device

After you add a device, further configuration options are available.

Options vary depending on your environment.

Example

  • Edit configuration: Use the wizard to modify selected device settings. See Add a Device in this topic.

  • Delete this device: Type yes to confirm that you want to delete the device.

How Do I Get Here?

SecureTrack > Monitoring > Manage Devices