Cisco IOS

Cisco IOS is one of the InsightIDR DHCP event sources and therefore provides data for InsightIDR to produce asset details, IP address history, incident details from your network, and other highly useful insights.

Before You Begin

In order for InsightIDR to have the Cisco IOS data, you'll need to turn on logging in the Cisco appliance.

Follow the directions here: https://supportforums.cisco.com/document/24661/how-configure-logging-cisco-ios.

  1. Run the following command to turn on logging: > debug ip dhcp server events
  2. Run the following command to turn on the required timestamps for the Rapid7 parser:
1
> service timestamps debug datetime year msec show-timezone
2
> service timestamps log datetime year msec show-timezone

Dynamic IP assignment

Cisco IOS devices can be used to dynamically assign IP addresses in a network; however, these devices do not log the hostname of the machine that it leased an IP address to.

In order to correlate DHCP leases with real machines within the network, the InsightIDR collector will make a reverse DNS request for the machine's hostname. Because of this, in order to properly ingest Cisco IOS DHCP data, reverse DNS requests must be allowed on your network's DNS servers.

DNS Configuration

Please make sure that DNS is properly configured on your collector host.

Configure InsightIDR to collect data from the event source

After you complete the prerequisite steps and configure the event source to send data, you must add the event source in InsightIDR.

To configure the new event source in InsightIDR:

  1. From the left menu, go to **Data Collection **and click Setup Event Source > Add Event Source.
  2. Do one of the following:
    • Search for Cisco IOS in the event sources search bar.
    • In the Product Type filter, select DHCP.
  3. Select the Cisco IOS event source tile.
  4. Choose your collector. You can also name your event source if you want.
  5. Choose the timezone that matches the location of your event source logs.
  6. Optionally choose to send unparsed logs.
  7. Configure any Advanced Event Source Settings.
  8. Select a collection method.
  9. Optionally, choose to Encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.
  10. Click Save.

Troubleshooting

Use one of the following solutions to resolve the Cisco IOS problem:

  • Debug Mode
  • Unable to Perform Reverse DNS Lookup

Debug Mode

The following command ensures that the debug mode survives a server restart:

text
1
> event manager applet EnableDebugging
2
> event syslog occurs 1 pattern "%SYS-5-RESTART"
3
> action 1.0 cli command "enable"
4
> action 2.0 cli command "debug ip dhcp server events"

For more information on how to enable debugging on your router, please see this article: http://blog.ipspace.net/2007/06/re-enable-debugging-on-router-reload.html.

Unable to Perform Reverse DNS Lookup

If you are experiencing issues enabling or performing reverse DNS lookups on your Collector, it may be because InsightIDR cannot associate an IP address with a host, which prevents user attribution and data correlation.

To fix this problem:

  1. install the Insight Agent on all of your assets; the Insight Agent automatically reports its hostname IP address to InsightIDR.
  2. Add the static IP addresses for your Cisco IOS box instead of as an Event Source. Do this under Settings > Static IP Ranges.

This forces the Collector to perform a reverse DNS lookup for IP addresses it cannot find via DHCP or with the Insight Agent.