Enterasys Security Information and Event Manager, Configuration Manual

Page: 81 / 426

Configuring DSMs
Cisco IOS 65
Before configuring a Cisco NAC device in SIEM, you must configure your device to
send syslog events to SIEM.
To configure the device to send syslog events to SIEM:
Step 1
Log in to the Cisco NAC user interface.
Step 2
In the Monitoring section, select Event Logs .
Step 3
Click the Syslog Settings tab.
Step 4
In the Syslog Server Address field, type the IP address of your SIEM system.
Step 5
In the Syslog Server Port field, type the syslog port. The default is 512.
Step 6
In the System Health Log Interval field, type the frequency, in minutes, for
system statistic log events.
Step 7
Click Update .
Step 8
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cisco NAC device:

From the Log Source Type drop-down list box, select Cisco NAC Appliance .
For more information on configuring log sources, see the Log Sources User
Guide .
Cisco IOS
You can integrate Cisco IOS series devices with SIEM. A Cisco IOS DSM accepts
Cisco IOS events using syslog. SIEM records all relevant events.
NOTE
Make sure all Access Control Lists (ACLs) are set to LOG.
Before you configure SIEM to integrate with a Cisco IOS server, you must:
Step 1
Type the following command to log in to the router in privileged-exec.
enable
Step 2
Type the following command to switch to configuration mode:
conf t
Step 3
Type the following commands:
logging <IP address>
logging source-interface <interface>
Where:
<
IP address>
is the IP address hosting SIEM and the SIM components.
<interface>
is the name of the interface, for example, dmz, lan, ethernet0, or
ethernet1.
Step 4
Type the following to configure the priority level: