Configurazione syslog SDWAN Cisco IOS XE TLS sul server syslog-ng

Introduzione

Questo documento descrive una guida completa per la configurazione di un server syslog TLS su dispositivi SD-WAN Cisco IOS® XE.

Prerequisiti

Prima di procedere con la configurazione di un server syslog TLS su dispositivi SD-WAN Cisco IOS XE, verificare che siano soddisfatti i seguenti requisiti:

Requisiti

Cisco raccomanda la conoscenza dei seguenti argomenti:

• Controller SD-WAN: verificare che la rete includa controller SD-WAN configurati correttamente.

• Cisco IOS XE SD-WAN Router: router compatibile che esegue l'immagine Cisco IOS XE SD-WAN.

• Syslog Server - Un server Syslog basato su Ubuntu, ad esempio syslog-ng, per la raccolta e la gestione dei dati di log.

Componenti usati

Le informazioni fornite in questo documento si basano sulle seguenti versioni software e hardware:

• vManage: Versione 20.9.4

• Cisco IOS XE SD-WAN: Versione 17.9.4

• Ubuntu Versione 2.04

• syslog-ng Versione 3.27

Le informazioni discusse in questo documento fanno riferimento a dispositivi usati in uno specifico ambiente di emulazione. Su tutti i dispositivi menzionati nel documento la configurazione è stata ripristinata ai valori predefiniti. Se la rete è operativa, valutare attentamente eventuali conseguenze derivanti dall'uso dei comandi.

Configurazione

1. Installazione di syslog-ng su computer Ubuntu

Per configurare syslog-ng sul server Ubuntu, attenersi alla seguente procedura per garantire la corretta installazione e configurazione.

Passaggio 1. Configurare le impostazioni di rete

Dopo l'installazione di Ubuntu Server, configurare un indirizzo IP statico e un server DNS per garantire che il computer possa accedere a Internet. Questa operazione è fondamentale per il download di pacchetti e aggiornamenti.

Passaggio 2. Installare syslog-ng

Aprire un terminale sul computer Ubuntu ed eseguire:

sudo apt-get install syslog-ng sudo apt-get install syslog-ng openssl

2. Installare l'autorità di certificazione radice sul server Syslog per l'autenticazione del server

Creazione di directory e generazione di chiavi

cd /etc/syslog-ng mkdir cert.d key.d ca.d cd cert.d openssl genrsa -out ca.key 2048 openssl req -new -x509 -key ca.key -out PROXY-SIGNING-CA.ca -days 730 # Copy key to the key.d folder cp ca.key ../key.d

Calcola impronta digitale

Eseguire il comando e copiare l'output:

openssl x509 -in PROXY-SIGNING-CA.ca -fingerprint -noout | awk -F "=" '{print $2}' | sed 's/://g' | impronta digitale.txt
# Output di esempio: 54F371C8EE2BFB06E2C2D0944245C288FBB07163

3. Configurare il file di configurazione del server syslog-ng

Modificare il file di configurazione syslog-ng:

sudo nano /etc/syslog-ng/syslog-ng.conf

Aggiungere la configurazione:

source s_src { network( ip(0.0.0.0) port(6514) transport("tls") tls( key-file("/etc/syslog-ng/key.d/ca.key") cert-file("/etc/syslog-ng/cert.d/PROXY-SIGNING-CA.ca") peer-verify(optional-untrusted) ) ); }; destination remote { file("/var/log/syslog"); }; log { source(s_src); destination(remote); };

4. Installare Root Certificate Authority sul dispositivo Cisco IOS XE SD-WAN per l'autenticazione del server

Configurazione dalla CLI

1. Accedere alla modalità di configurazione:

config-t

2. Configurare il trust point:

crypto pki trustpoint PROXY-SIGNING-CA enrollment url bootflash: revocation-check none rsakeypair PROXY-SIGNING-CA 2048 subject-name cn=proxy-signing-cert fqdn none fingerprint 54F371C8EE2BFB06E2C2D0944245C288FBB07163 >> The fingerprint configured was obtained from the fingerprint.txt file above commit

3. Copiare PROXY-SIGNING-CA.ca dal server syslog al router bootflash utilizzando lo stesso nome.

4. Autenticare il trust point:

crypto pki authenticate PROXY-SIGNING-CA

example:
Router#crypto pki authenticate PROXY-SIGNING-CA
Reading file from bootflash:PROXY-SIGNING-CA.ca
Certificate has the attributes:
Fingerprint MD5: 7A97B30B 2AE458FF D9E7D91F 66488DCF
Fingerprint SHA1: 21E0F09B B67B2E9D 706DBE69 856E5AA3 D39A268A
Trustpoint Fingerprint: 21E0F09B B67B2E9D 706DBE69 856E5AA3 D39A268A
Certificate validated - fingerprints matched.
Trustpoint CA certificate accepted.

5. Registrare il trust point:

crypto pki enroll PROXY-SIGNING-CA

example:
vm32#crypto pki enroll PROXY-SIGNING-CA
Start certificate enrollment ..
The subject name in the certificate will include: cn=proxy-signing-cert
The fully-qualified domain name will not be included in the certificate
Certificate request sent to file system
The 'show crypto pki certificate verbose PROXY-SIGNING-CA' commandwill show the fingerprint.

6. Copiare PROXY-SIGNING-CA.req dal router al server syslog.

Firmare il certificato sul server Syslog

openssl x509 -in PROXY-SIGNING-CA.req -req -CA PROXY-SIGNING-CA.ca -CAkey ca.key -out PROXY-SIGNING-CA.crt -CAcreateserial -extensions ca_extensions

7. Copiare il file generato (PROXY-SIGNING-CA.crt) al bootflash del router. copy scp: bootflash

8. Importare il certificato:

crypto pki import PROXY-SIGNING-CA certificate
example:
Router# crypto pki import PROXY-SIGNING-CA certificate
% The fully-qualified domain name will not be included in the certificate
% Request to retrieve Certificate queued

Convalida della configurazione

show crypto pki trustpoint PROXY-SIGNING-CA status

example:
Router#show crypto pki trustpoint PROXY-SIGNING-CA status
Trustpoint PROXY-SIGNING-CA:
Issuing CA certificate configured:
Subject Name:
o=Internet Widgits Pty Ltd,st=Some-State,c=AU
Fingerprint MD5: 7A97B30B 2AE458FF D9E7D91F 66488DCF
Fingerprint SHA1: 21E0F09B B67B2E9D 706DBE69 856E5AA3 D39A268A
Router General Purpose certificate configured:
Subject Name:
cn=proxy-signing-cert
Fingerprint MD5: 140A1EAB FE945D56 D1A53855 FF361F3F
Fingerprint SHA1: ECA67413 9C102869 69F582A4 73E2B98C 80EFD6D5
Last enrollment status: Granted
State:
Keys generated ............. Yes (General Purpose, non-exportable)
Issuing CA authenticated ....... Yes
Certificate request(s) ..... Yes

5. Configurare il server syslog TLS sul router Cisco IOS XE SD-WAN

Configurare il server syslog utilizzando i seguenti comandi:

logging trap syslog-format rfc5424 logging source-interface GigabitEthernet0/0/0 logging tls-profile tls-profile logging host X.X.X.X transport tls profile tls-profile tls-version TLSv1.2

6. Verifiche

Controllo dei log sul router

show logging

Showing last 10 lines
Log Buffer (512000 bytes):
Apr 9 05:59:48.025: %DMI-5-CONFIG_I: R0/0: dmiauthd: Configured from NETCONF/RESTCONF by admin, transaction-id 189410
Apr 9 05:59:48.709: %DMI-5-AUTH_PASSED: R0/0: dmiauthd: User 'vmanage-admin' authenticated successfully from 1.1.1.1:58393 for netconf over ssh. External groups:
Apr 9 05:59:50.015: %LINK-5-CHANGED: Interface GigabitEthernet0/0/1, changed state to administratively down
Apr 9 05:59:51.016: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/1, changed state to down
Apr 9 05:59:52.242: %SYS-5-CONFIG_P: Configured programmatically by process iosp_dmiauthd_conn_100001_vty_100001 from console as admin on vty4294966494

Controllo dei log sul server Syslog

tail -f /var/log/syslog

root@server1:/etc/syslog-ng# tail -f /var/log/syslog
Apr 9 15:51:14 10.66.91.94 188 <189>1 2024-04-09T05:51:51.037Z - - - - - BOM%DMI-5-AUTH_PASSED: R0/0: dmiauthd: User 'vmanage-admin' authenticated successfully from 1.1.1.1:38032 for netconf over ssh. External groups:
Apr 9 15:59:10 10.66.91.94 177 <189>1 2024-04-09T05:59:47.463Z - - - - - BOM%SYS-5-CONFIG_P: Configured programmatically by process iosp_dmiauthd_conn_100001_vty_100001 from console as admin on vty4294966494
Apr 9 15:59:10 10.66.91.94 177 <189>1 2024-04-09T05:59:47.463Z - - - - - BOM%SYS-5-CONFIG_P: Configured programmatically by process iosp_dmiauthd_conn_100001_vty_100001 from console as admin on vty4294966494
Apr 9 15:59:10 10.66.91.94 143 <189>1 2024-04-09T05:59:47.463Z - - - - - BOM%DMI-5-CONFIG_I: R0/0: dmiauthd: Configured from NETCONF/RESTCONF by admin, transaction-id 189410
Apr 9 15:59:11 10.66.91.94 188 <189>1 2024-04-09T05:59:48.711Z - - - - - BOM%DMI-5-AUTH_PASSED: R0/0: dmiauthd: User 'vmanage-admin' authenticated successfully from 1.1.1.1:58393 for netconf over ssh. External groups:
Apr 9 15:59:13 10.66.91.94 133 <189>1 2024-04-09T05:59:50.016Z - - - - - BOM%LINK-5-CHANGED: Interface GigabitEthernet0/0/1, changed state to administratively down
Apr 9 15:59:13 10.66.91.94 137 <189>1 2024-04-09T05:59:50.016Z - - - - - BOM%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/1, changed state to down
Apr 9 15:59:15 10.66.91.94 177 <189>1 2024-04-09T05:59:52.242Z - - - - - BOM%SYS-5-CONFIG_P: Configured programmatically by process iosp_dmiauthd_conn_100001_vty_100001 from console as admin on vty4294966494
Apr 9 15:59:15 10.66.91.94 177 <189>1 2024-04-09T05:59:52.242Z - - - - - BOM%SYS-5-CONFIG_P: Configured programmatically by process iosp_dmiauthd_conn_100001_vty_100001 from console as admin on vty4294966494
Apr 9 15:59:18 10.66.91.94 188 <189>1 2024-04-09T05:59:55.286Z - - - - - BOM%DMI-5-AUTH_PASSED: R0/0: dmiauthd: User 'vmanage-admin' authenticated successfully from 1.1.1.1:34575 for netconf over ssh. External groups:
Apr 9 15:59:21 10.66.91.94 113 <187>1 2024-04-09T05:59:58.882Z - - - - - BOM%LINK-3-UPDOWN: Interface GigabitEthernet0/0/1, changed state to up
Apr 9 15:59:21 10.66.91.94 135 <189>1 2024-04-09T05:59:59.882Z - - - - - BOM%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/1, changed state to up
Apr 9 15:59:28 10.66.91.94 177 <189>1 2024-04-09T06:00:05.536Z - - - - - BOM%SYS-5-CONFIG_P: Configured programmatically by process iosp_dmiauthd_conn_100001_vty_100001 from console as admin on vty4294966494
Apr 9 15:59:43 10.66.91.94 188 <189>1 2024-04-09T06:00:20.537Z - - - - - BOM%DMI-5-AUTH_PASSED: R0/0: dmiauthd: User 'vmanage-admin' authenticated successfully from 1.1.1.1:43530 for netconf over ssh. External groups:

Screenshot dell'acquisizione dei pacchetti e potrai vedere le comunicazioni crittografate in corso:

Trap logging: level informational, 6284 message lines logged
    Logging to 10.66.91.170  (tls port 6514, audit disabled,
          link up),
          131 message lines logged, 
          0 message lines rate-limited, 
          0 message lines dropped-by-MD, 
          xml disabled, sequence number disabled
          filtering disabled
          tls-profile: tls-proile
    Logging Source-Interface:       VRF Name:
    GigabitEthernet0/0/0            
TLS Profiles: 
    Profile Name: tls-proile
          Ciphersuites: Default
          Trustpoint: Default
          TLS version: TLSv1.2