The Cisco ACI must be configured to send log data to a central log server for log retention and forwarding alerts to the administrators and the information system security officer (ISSO).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-271931 | CACI-ND-000016 | SV-271931r1114365_rule | High |
| Description |
| The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can be used to detect weaknesses in security that enable the network IA team to find and address these weaknesses before breaches can occur. Reviewing these logs, whether before or after a security breach, is important in determining whether someone is an internal employee or an outside threat. |
| STIG | Date |
| Cisco ACI NDM Security Technical Implementation Guide | 2025-06-13 |
Details
| Check Text (C-75981r1114359_chk) |
| Verify the ACI Fabric is configured to send event messages to syslog servers. Example configuration: logging server-group SYSLOG_SERVER_GROUP apic1(config)# server 10.0.0.10 port 514 severity informational apic1(config)# server 10.0.0.20 port 514 severity informational . . . apic1(config)# syslog monitoring source MyEventSource apic1(config)# syslog monitoring source MyEventSource destination SYSLOG_SERVER_GROUP If the Cisco ACI is not configured to send audit records to at least one central syslog server, this is a finding. |
| Fix Text (F-75888r1114364_fix) |
| Configure the Cisco switch to send log records to a syslog servers. 1: Create a logging server group. logging server-group <group_name> server <server_ip> port <port_number> severity <severity_level> 2: Configure monitoring sources. Define which types of events (audit, event, fault, session) to log to the remote servers. Associate the monitoring source with the server group. syslog monitoring source <source_name> syslog monitoring source <source_name> destination <logging_server_group_name> Example configuration: apic1(config)# logging server-group SYSLOG_SERVER_GROUP apic1(config)# server 10.0.0.10 port 514 severity informational apic1(config)# server 10.0.0.20 port 514 severity informational apic1(config)# syslog monitoring source MyEventSource apic1(config)# syslog monitoring source MyEventSource destination SYSLOG_SERVER_GROUP |