Secure syslog

[GaryShainberg]

Guys and Girls,

I have a need to take the syslogs from about 20 networks all within the same organisation has anyone one done this in a secure way - I guess I could use site:site VPN's but I would rather not unless there is no other option.

Any thoughts / suggestions would be appreciated

Gary

[jdsilva]

Syslog itself has no built in encryption or authentication so you will need to build something that can provide whatever you need. If you have to go over the Internet then a VPN tunnel is a good option. 

[BrandonS]

I agree VPN is probably it, but you have your own or a hosted, central syslog server?  I suppose you could store and forward syslog securely with TLS from each site via a local machine or VM.  Since Meraki does not support encrypted syslog it would be local syslog traffic that is secure on your internal network and then forward it using TLS encrypted syslog to your central server.  Here is something about it I was reading in relation to a cloud syslog server I use: https://help.papertrailapp.com/kb/configuration/encrypting-remote-syslog-with-tls-ssl

[GaryShainberg]

Brandon, thanks for this and I'll have a read, but I think I have come to the same conclusion as you guys that from Meraki kit, it cant be done, but using either a local collector and then via TLS or keeping it on-net and using vpn tunnels would work.

Thanks

I'll leave this open for a couple of days, just to see if anyone else has any thoughts

-Gary

[G_ControlScan]

Gary,

When looking to send syslog over VPN read this article.

https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Syslog_Server_Over...

What is not mentioned in the article, when sending SYSLOG from a MX, over a VPN tunnel, the source will be the highest VLAN #. 

If you have:

VLAN 5 - 192.168.5.0/24

VLAN 20 - 192.168.20.0/24

The source will be 192.168.20.1 

You may want to consider a Management VLAN 254,   192.168.254.0/29 and do a network NAT to a unique site subnet.  

[GaryShainberg]

Hi there,

Much thanks for this as its sounds like the classic "gotcha" of which one would spend hours trying to solve.