6

What I have got set up are my Cisco switches send SNMP traps to my intermapper server. I did that so I could see who is logging in or trying to log in. That part is working. What I need to do is create a probe, then I can set up notifications and so on.

The SNMP trap looks like this

SNMPv2-SMI::enterprises.9.9.41.2 (1) { "SEC_LOGIN", "5", "LOGIN_FAILED", "Login failed [user: admin] [Source: 10.1.1.45] [localport: 22] [Reason: Login Authentication Failed] at 22:39:45 MDT Tue Jul 16 2013", "902084201" }

What I am trying to accomplish is the availability to notify me when someone logs into the switches. Since I am the only one who logs into them it would be nice to see if someone try to log in or actually logs in.

Improve this question
7
  • what kind of probe ae you looking for, an snmp trap receiver?
    – Mike Pennington
    Commented Jul 17, 2013 at 12:38
  • Yeah I think so, what I am trying to accomplish is the availability to notify me when someone logs into the switches. Since I am the only one who logs into them it would be nice to see if someone try to log in or actually logs in.
    – Jonathan
    Commented Jul 17, 2013 at 12:50
  • Hi mate, Here is my suggestion: - use "login on-success log / login on-failure log" commands - then use EEM as for any of these two commands notify you in the syslog, it will send an email (automatically). This is what I do on my critical equipments. If you are interested I will post the EEM script.
    – laf
    Commented Jul 18, 2013 at 6:26
  • @laf So the switch sends the email? That would be great if you posted the script.
    – Jonathan
    Commented Jul 18, 2013 at 18:38
  • Hi mate, Unfortunately EEM is not supported on regular switches (2960, 35xx, 37xx). It's supported on 6500 platform, but that's pretty much all...
    – laf
    Commented Jul 19, 2013 at 12:45

1 Answer 1

Reset to default
5

If all you need is login notification and if you don't care about SNMP vs Syslog, you can use IOS built-in syslog for authentication failures and success. It also can block IP addresses with failed logins.

login block-for 300 attempts 5 within 60
login on-failure log
login on-success log

This is the message for success

Jul 18 06:55:26.408: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: cisco]
 [Source: 10.10.1.5] [localport: 23] at 06:55:26 UTC Thu Jul 18 2013

This is the message for a telnet failure

Jul 18 06:56:16.963: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] 
 [Source: 10.10.1.5] [localport: 23] [Reason: Login Authentication Failed] at 06:56:16 UTC 
 Thu Jul 18 2013
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.