Accenture MDR Quick Start Guide for Cisco StarOS

This quick start guide will help Accenture MDR customers configure Cisco StarOS to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Cisco StarOS

Pre-requisites:

Steps to configure Syslog:

1. Mode - you should go into “Context Configuration“ mode
   Exec > Global Configuration > Context Configuration

2. Configure context
   context “context_name”
   context_name -> A context is a logical grouping or mapping of configuration parameters that pertain to various physical ports, logical IP interfaces, and services. A context can be thought of as a virtual private network (VPN).

3. After entering the above command sequence results in the following prompt:
   [context_name]host_name(config-ctx)#

4. Run below command to configure syslog
   Command - “logging syslog LCP IP event-verbosity full facility local7 msg-format rfc3164 pdu-data none pdu-verbosity 5 port 514”
   LCP IP - Provide LCP IP

5. Syslog configuration completed.

Field Details:

syslog ip_address - Specifies the IP address of a system log server on the network in IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

event-verbosity { min | concise | full } - select full

Specifies the level of detail to use in logging of events. Detail level must be one of the following:

• min : Displays minimal information about the event. Information includes event name, facility, event ID, severity level, date, and time.

• concise : Displays detailed information about the event, but does not provide the event source within the system.

• full : Displays detailed information about event, including source information, identifying where within the system the event was generated.

facility facilities - Default: local7

Specifies the local facility for which the system logging server's logging options shall be applied. Local facility must be one of the following:

• local0 — Pertains to syslog severity level of 0, Emergency

• local1 — Pertains to syslog severity level of 1, Alert

• local2 — Pertains to syslog severity level of 2, Critical

• local3 — Pertains to syslog severity level of 3, Error

• local4 — Pertains to syslog severity level of 4, Warning

• local5 — Pertains to syslog severity level of 5, Notice

• local6 — Pertains to syslog severity level of 6, Informational

• local7 — Pertains to syslog severity level of 7, Debug

msg-format { rfc3164 | rfc5424 } - Configures the message format for each system log server as per RFC3164 or RFC5424. Default: rfc3164.

pdu-data { none | hex | hex-ascii } - select none

Specifies output format for packet data units when logged. Format must be one of the following:

• none : Displays data in raw format.

• hex : Displays data in hexadecimal format.

• hex-ascii :Displays data in hexadecimal and ASCII format (similar to a main-frame dump).

pdu-verbosity pdu_level - Specifies the level of verboseness to use in logging of packet data units as a value from 1 through 5, where 5 is the most detailed.

port number - Specifies an alternate port number for the system log server. Default: 514.

LCP Configuration Parameters

Table 1-2: The Cisco Star OS event collector (Syslog -3994) properties to be configured by Accenture are given in the table.