6

What I have got set up are my Cisco switches send SNMP traps to my intermapper server. I did that so I could see who is logging in or trying to log in. That part is working. What I need to do is create a probe, then I can set up notifications and so on.

The SNMP trap looks like this

SNMPv2-SMI::enterprises.9.9.41.2 (1) { "SEC_LOGIN", "5", "LOGIN_FAILED", "Login failed [user: admin] [Source: 10.1.1.45] [localport: 22] [Reason: Login Authentication Failed] at 22:39:45 MDT Tue Jul 16 2013", "902084201" }

What I am trying to accomplish is the availability to notify me when someone logs into the switches. Since I am the only one who logs into them it would be nice to see if someone try to log in or actually logs in.

7
  • what kind of probe ae you looking for, an snmp trap receiver? Jul 17, 2013 at 12:38
  • Yeah I think so, what I am trying to accomplish is the availability to notify me when someone logs into the switches. Since I am the only one who logs into them it would be nice to see if someone try to log in or actually logs in.
    – Jonathan
    Jul 17, 2013 at 12:50
  • Hi mate, Here is my suggestion: - use "login on-success log / login on-failure log" commands - then use EEM as for any of these two commands notify you in the syslog, it will send an email (automatically). This is what I do on my critical equipments. If you are interested I will post the EEM script.
    – laf
    Jul 18, 2013 at 6:26
  • @laf So the switch sends the email? That would be great if you posted the script.
    – Jonathan
    Jul 18, 2013 at 18:38
  • Hi mate, Unfortunately EEM is not supported on regular switches (2960, 35xx, 37xx). It's supported on 6500 platform, but that's pretty much all...
    – laf
    Jul 19, 2013 at 12:45

1 Answer 1

5

If all you need is login notification and if you don't care about SNMP vs Syslog, you can use IOS built-in syslog for authentication failures and success. It also can block IP addresses with failed logins.

login block-for 300 attempts 5 within 60
login on-failure log
login on-success log

This is the message for success

Jul 18 06:55:26.408: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: cisco]
 [Source: 10.10.1.5] [localport: 23] at 06:55:26 UTC Thu Jul 18 2013

This is the message for a telnet failure

Jul 18 06:56:16.963: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] 
 [Source: 10.10.1.5] [localport: 23] [Reason: Login Authentication Failed] at 06:56:16 UTC 
 Thu Jul 18 2013

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.