Detections
Analytics

1.1.9 Syslog with TLS support

Information

Syslog over TLS is a secure standard (RFC 5425) that encrypts log messages in transit using Transport Layer Security. It protects sensitive operational and security data from interception and tampering

Syslog messages may transit several hops to arrive at the intended
collector. Some intermediary networks may not be trusted by the
originator, relay, or receiver because the network is in a different
security domain or at a different security level from the originator,
relay, or collector. Another security concern is that the
originator, relay, or receiver itself is in an insecure network.

By using TLS connections, syslog is better protected against attacks and information leakage.

Solution

- Create an SSL profile

switch(config-mgmt-security)#ssl profile syslog-profile
switch(config-mgmt-sec-ssl-profile-syslog-profile)#certificate clientCert key ClientKey
switch(config-mgmt-sec-ssl-profile-syslog-profile)# trust certificate serverCA
switch(config-mgmt-sec-ssl-profile-syslog-profile)#

 - Define syslog server
switch(config)#logging vrf MGMT host 10.1.1.1 protocol tls ssl-profile syslog-profile

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9(3)

Plugin: Arista

Control ID: f887ec2800efd30e153bd72ff98dd3216c7f3cd7135f5aa0c35cf1bb83a58758