Title

The Cisco ACI must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). (Cat I impact)

Discussion

The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can used to detect weaknesses in security that enable the network IA team to find and address these weaknesses before breaches can occur. Reviewing these logs, whether before or after a security breach, are important in showing whether someone is an internal employee or an outside threat.

Check Content

Verify the ACI Fabric is configured to send event messages to syslog servers. Example configuration: logging server-group SYSLOG_SERVER_GROUP apic1(config)# server 10.0.0.10 port 514 severity informational apic1(config)# server 10.0.0.20 port 514 severity informational . . . apic1(config)# syslog monitoring source MyEventSource apic1(config)# syslog monitoring source MyEventSource destination SYSLOG_SERVER_GROUP If the ACI is not configured to send audit records to redundant central syslog server that are separate from the ACI, this is a finding.

Fix Text

Configure the Cisco switch to send log records to a syslog servers. Step 1: Create a logging server group. logging server-group <group_name> server <server_ip> port <port_number> severity <severity_level> Step 2: Configure monitoring sources. Define which types of events (audit, event, fault, session) to log to the remote servers. Associate the monitoring source with the server group. syslog monitoring source <source_name> syslog monitoring source <source_name> destination <logging_server_group_name> Example configuration: apic1(config)# logging server-group SYSLOG_SERVER_GROUP apic1(config)# server 10.0.0.10 port 514 severity informational apic1(config)# server 10.0.0.20 port 514 severity informational apic1(config)# syslog monitoring source MyEventSource apic1(config)# syslog monitoring source MyEventSource destination SYSLOG_SERVER_GROUP

Additional Identifiers

Rule ID: SV-271931r1067366_rule

Vulnerability ID: V-271931

Group Title: SRG-APP-000516-NDM-000350

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.