0

I would like to understand if its possible for us to have two logging source-interface configured on Cisco Switch:

  1. logging source-interface vlan1 (For syslogs)
  2. logging source-interface vlan2 (For onboarding devices)
2
  • Do you really mean two different source interfaces or rather two different syslog destinations?
    – Zac67
    Jun 21 at 14:03
  • 1
    The software you use on the logs should be able to give you separate reports for your VLANs.
    – Ron Maupin
    Jun 21 at 14:49

2 Answers 2

4

No. You can have only one source interface statement. If you try to add the second, it will simply overwrite the first.

1

While Ron is right with the single source interface statement, depending on the network environment, you might be able to pull off a trick.

Still, whichever way you'll turn this, it's going to be very "custom" - just not to say "ugly". See below for a comment

  • you need a switch with limited L3 switching capabilities (multiple SVIs, can add static routes)
  • the given (security) environment must permit that the switch has more than one SVI
  • the given (security) environment must allow for the switch to become a (potential) routing backdoor between the subnets of VLAN 1 and VLAN 2
  • there must be an upstream routing device/gateway/router which has (sub)interfaces into these two VLANs 1 and 2

Then you may consider adding a configuration in the style of

vlan 1
 name MYVLAN1

vlan 2
 name MYVLAN2

interface vlan 1
 ip address <ip.of.vlan1.x>

interface vlan 2
 ip address <ip.of.vlan2.x>

ip route <syslog1> 255.255.255.255 vlan1 <ip.of.gw.in.vlan1>
ip route <syslog2> 255.255.255.255 vlan2 <ip.of.gw.in.vlan2>
no ip logging source-interface

Then, the switch should pick the given egress IP interface as source when sending towards syslog1 or syslog2

Depending on what you can do on the given upstream gateway/firewall (some NAT magic) and/or the syslog servers (2nd IP on NIC), both syslog1 and syslog2 might even be the same single syslog server.

So the trick here is to have the switch send syslog to two seemingly different syslog servers.

Comment 1:

Are you possibly looking for a solution that is better solved in a totally different way? (see https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem)

Are you trying to seperate syslog messages based on application case? That is probably best done on the syslog server itself, by message type and keywords.

Comment 2:

Let's assume you achieve the ability to send syslog with two different source addresses by sending to two different syslog servers.

On the switch (on all switches?) you will still need to implement a local filtering logic of what syslog messages to send to which syslog server (see https://community.cisco.com/t5/network-management/send-certain-syslog-messages-to-different-syslog-servers/td-p/2247930 for a few examples.)

This in turn begs the question: Why not implement the same message filtering logic on the syslog server(s), where a proper and fast toolset/framework for message filtering is quite probably built-in? ... see Comment 1, above.

1
  • 3
    I agree. Even if your solution does work (interesting idea by the way), I would find it much, much simpler to just use a log management solution that gets the data where it needs to be automatically. Jun 21 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.