From the course: Hardening and Secure Configuration: Ports, Baselines, Benchmarks, and Security Scoring
Join today to access over 26,500 courses taught by industry experts.
Network device logging and monitoring
From the course: Hardening and Secure Configuration: Ports, Baselines, Benchmarks, and Security Scoring
Network device logging and monitoring
A financial firm once had a trading outage. The network team rolled back a configuration change on a core router. But when asked who made it and why, they had no answer. The local log buffer had overwritten the entries. The syslog server had been decommissioned months earlier. The incident closed as unknown cause. Now let's fix that. In this lecture, we'll cover three things. One is the centralizing of logs. Second is logging configuration changes. And third, monitoring authentication events. So let's start with the centralization logging. Network devices have tiny local buffers, which wipe out on reboot. Relying on them is not a strategy. Send every router, switch, and firewall to a dedicated syslog server on your management network. Modern syslog with TCP or TLS not just with UDP. UDP can lose or spoof logs whereas TLS ensures they arrive intact and encrypted. So set your level to informational or notice which is enough to be useful without drowning the debug noise. Second, log…
Download courses and learn on the go
Watch courses on your mobile device without an internet connection. Download courses using your iOS or Android LinkedIn Learning app.
