Enterasys Security Information and Event Manager, Configuration Manual

Page: 83 / 426

Configuring DSMs
Cisco VPN 3000 Concentrator 67
To integrate Cisco Pix:
Step 1
Log into the Cisco PIX using a console connection, telnet, or SSH.
Step 2
Type the following command to access Privileged mode:
enable
Step 3
Type the following command to access Configuration mode:
conf t
Step 4
Enable logging and timestamp the logs:
logging on
logging timestamp
Step 5
Set the log level:
logging trap warning
Step 6
Configure logging to SIEM:
logging host <interface> <ip address>
Where:
<
interface
> is the name of the interface, for example, dmz, lan, ethernet0, or
ethernet1.
<
ip address
> is the IP address hosting SIEM and the SIM components.
Step 7
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cisco PIX device:

From the Log Source Type drop-down list box, select the Cisco PIX Firewall
option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about Cisco Pix devices, see your Cisco documentation.
Cisco VPN 3000
Concentrator
A SIEM Cisco VPN 3000 Concentrator DSM accepts Cisco VPN Concentrator
events using syslog. SIEM records all relevant events. Before you configure SIEM
to integrate with a Cisco VPN concentrator, you must:
Step 1
Log in to the Cisco VPN 3000 Concentrator command line interface (CLI).
Step 2
Type the following command to add a syslog server to your configuration:
set logging server <IP address>
Where
<IP address>
is the IP address of SIEM or your Event Collector.
Step 3
Type the following command to enable system message logging to the configured
syslog servers:
set logging server enable
Step 4
Set the facility and severity level for syslog server messages: