I would like to understand if its possible for us to have two logging source-interface configured on Cisco Switch:
- logging source-interface vlan1 (For syslogs)
- logging source-interface vlan2 (For onboarding devices)
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
While Ron is right with the single source interface statement, depending on the network environment, you might be able to pull off a trick.
Still, whichever way you'll turn this, it's going to be very "custom" - just not to say "ugly". See below for a comment
Then you may consider adding a configuration in the style of
vlan 1 name MYVLAN1 vlan 2 name MYVLAN2 interface vlan 1 ip address <ip.of.vlan1.x> interface vlan 2 ip address <ip.of.vlan2.x> ip route <syslog1> 255.255.255.255 vlan1 <ip.of.gw.in.vlan1> ip route <syslog2> 255.255.255.255 vlan2 <ip.of.gw.in.vlan2> no ip logging source-interface
Then, the switch should pick the given egress IP interface as source when sending towards syslog1 or syslog2
Depending on what you can do on the given upstream gateway/firewall (some NAT magic) and/or the syslog servers (2nd IP on NIC), both syslog1 and syslog2 might even be the same single syslog server.
So the trick here is to have the switch send syslog to two seemingly different syslog servers.
Are you possibly looking for a solution that is better solved in a totally different way? (see https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem)
Are you trying to seperate syslog messages based on application case? That is probably best done on the syslog server itself, by message type and keywords.
Let's assume you achieve the ability to send syslog with two different source addresses by sending to two different syslog servers.
On the switch (on all switches?) you will still need to implement a local filtering logic of what syslog messages to send to which syslog server (see https://community.cisco.com/t5/network-management/send-certain-syslog-messages-to-different-syslog-servers/td-p/2247930 for a few examples.)
This in turn begs the question: Why not implement the same message filtering logic on the syslog server(s), where a proper and fast toolset/framework for message filtering is quite probably built-in? ... see Comment 1, above.