Fortinet black logo

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

External Systems Configuration Guide

Cisco NX-OS Router and Switch

What is Discovered and Monitored

Protocol

Information Discovered

Metrics collected

Used for

SNMP (V1, V2c, V3)

Host name, IOS version, Hardware model, Memory size, Network interface details - name, address, mask and description Uptime, CPU and Memory utilization, Free processor and I/O memory, Free contiguous processor and I/O memory, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)

Availability and Performance Monitoring

SNMP (V1, V2c, V3)

Hardware component details: serial number, model, manufacturer, software and firmware versions of hardware components such as chassis, CPU, fan, power supply, network cards etc.

Hardware health: temperature, fan and power supply

Availability

SNMP (V1, V2c, V3)

Trunk port connectivity between switches and VLANs carried over a trunk port (via CDP MIB), ARP table

Topology and end-host location

SNMP (V1, V2c, V3)

BGP connectivity, neighbors, state, AS number

BGP state change

Routing Topology, Availability Monitoring

SNMP (V1, V2c, V3)

OSPF connectivity, neighbors, state, OSPF Area

OSPF state change

Routing Topology, Availability Monitoring

SNMP (V1, V2c, V3)

Class based QoS metrics: For (router interface, policy, class map) tuple: class map metrics including Pre-policy rate, post-police rate, drop rate and drop pct; police action metrics including conform rate, exceeded rate and violated rate; queue metrics including current queue length, max queue length and discarded packets

QoS performance monitoring

Telnet/SSH

Running and startup configuration, Image file name, Flash memory size, Running processes Startup configuration change, delta between running and startup configuration, Running process CPU and memory utilization Performance Monitoring, Security and Compliance

Telnet/SSH

End host Layer 2 port mapping: switch interface to VLAN id, end host IP/MAC address association

Syslog Device type> System logs and traffic logs matching acl statements Availability, Security and Compliance

Event Types

In ADMIN > Device Support > Event Types, search for "cisco-nxos" to see the event types associated with this device. 

Rules

There are no predefined rules for this device. 

Reports

There are no predefined reports for this device. 

Configuration

SNMP

FortiSIEM uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.

Telnet/SSH

FortiSIEM uses Telnet/SSH to communicate with this device. Refer to the product documentation for your device to enable Telnet/SSH.

These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in FortiSIEM have the permissions necessary to execute these commands on the device.

  • show startup-config
  • show running-config
  • show version
  • show flash
  • show context
  • show ip route
  • show cam dynamic
  • show mac-address-table
  • show mac address-table (for Nexus 1000v)
  • show vlan brief
  • show process cpu
  • show process mem
  • show disk0
  • enable
  • terminal length 0
Syslog

FortiSIEM processes events from this device via syslog sent by the device. Configure the device to send syslog to FortiSIEM as directed in the device's product documentation, and FortiSIEM will parse the contents.

  • For Syslog Server, or the server where the syslog should be sent, enter the IP address of your FortiSIEM virtual appliance.
  • For Port, enter 514.
  • Make sure that the syslog type is Common Event Format (CEF). The syslog format should be the same as that shown in the example.
NetFlow
Enable NetFlow on the Router
  1. Enter configuration mode.
  2. Run this command.
    feature netflow
Create a Flow Template and Define the Fields to Export

You can can also try using the pre-defined NetFlow template.

# show flow record netflow-original
Flow record netflow-original:
    Description: Traditional IPv4 input NetFlow with origin ASs
    No. of users: 1
    Template ID: 261
    Fields:
         match ipv4 source address
         match ipv4 destination address
         match ip protocol
         match ip tos
         match transport source-port
         match transport destination-port
         match interface input
         match interface output
         match flow direction
         collect routing source as
         collect routing destination as
         collect routing next-hop address ipv4
         collect transport tcp flags
         collect counter bytes
         collect counter packets
         collect timestamp sys-uptime first
         collect timestamp sys-uptime last
Set up NetFlow Exporter

Run these commands.

flow exporter FortiSIEMFlowAnalyzer
description export netflow to FortiSIEM
destination <FortiSIEMIp>export Version 9
transport udp 2055
source vlan613
Associate the Record to the Exporter Using a Flow Monitor

In this example the flow monitor is called FortiSIEMMonitoring.

Run these commands. 

flow monitor FortiSIEMMonitoring
exporter FortiSIEMFlowAnalyzer
record netflow-original
Apply the Flow Monitor to Every Interface

Run these commands.

interface Vlan612
ip flow monitor Monitortac7000 input
exit
interface Vlan613
ip flow monitor Monitortac7000 input
exit

You can now check the configuration using the show commands. 

Settings for Access Credentials

For SNMP, Telnet, and SSH access credentials, see Access Credentials.

Cisco NX-OS Router and Switch

What is Discovered and Monitored

Protocol

Information Discovered

Metrics collected

Used for

SNMP (V1, V2c, V3)

Host name, IOS version, Hardware model, Memory size, Network interface details - name, address, mask and description Uptime, CPU and Memory utilization, Free processor and I/O memory, Free contiguous processor and I/O memory, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)

Availability and Performance Monitoring

SNMP (V1, V2c, V3)

Hardware component details: serial number, model, manufacturer, software and firmware versions of hardware components such as chassis, CPU, fan, power supply, network cards etc.

Hardware health: temperature, fan and power supply

Availability

SNMP (V1, V2c, V3)

Trunk port connectivity between switches and VLANs carried over a trunk port (via CDP MIB), ARP table

Topology and end-host location

SNMP (V1, V2c, V3)

BGP connectivity, neighbors, state, AS number

BGP state change

Routing Topology, Availability Monitoring

SNMP (V1, V2c, V3)

OSPF connectivity, neighbors, state, OSPF Area

OSPF state change

Routing Topology, Availability Monitoring

SNMP (V1, V2c, V3)

Class based QoS metrics: For (router interface, policy, class map) tuple: class map metrics including Pre-policy rate, post-police rate, drop rate and drop pct; police action metrics including conform rate, exceeded rate and violated rate; queue metrics including current queue length, max queue length and discarded packets

QoS performance monitoring

Telnet/SSH

Running and startup configuration, Image file name, Flash memory size, Running processes Startup configuration change, delta between running and startup configuration, Running process CPU and memory utilization Performance Monitoring, Security and Compliance

Telnet/SSH

End host Layer 2 port mapping: switch interface to VLAN id, end host IP/MAC address association

Syslog Device type> System logs and traffic logs matching acl statements Availability, Security and Compliance

Event Types

In ADMIN > Device Support > Event Types, search for "cisco-nxos" to see the event types associated with this device. 

Rules

There are no predefined rules for this device. 

Reports

There are no predefined reports for this device. 

Configuration

SNMP

FortiSIEM uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.

Telnet/SSH

FortiSIEM uses Telnet/SSH to communicate with this device. Refer to the product documentation for your device to enable Telnet/SSH.

These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in FortiSIEM have the permissions necessary to execute these commands on the device.

  • show startup-config
  • show running-config
  • show version
  • show flash
  • show context
  • show ip route
  • show cam dynamic
  • show mac-address-table
  • show mac address-table (for Nexus 1000v)
  • show vlan brief
  • show process cpu
  • show process mem
  • show disk0
  • enable
  • terminal length 0
Syslog

FortiSIEM processes events from this device via syslog sent by the device. Configure the device to send syslog to FortiSIEM as directed in the device's product documentation, and FortiSIEM will parse the contents.

  • For Syslog Server, or the server where the syslog should be sent, enter the IP address of your FortiSIEM virtual appliance.
  • For Port, enter 514.
  • Make sure that the syslog type is Common Event Format (CEF). The syslog format should be the same as that shown in the example.
NetFlow
Enable NetFlow on the Router
  1. Enter configuration mode.
  2. Run this command.
    feature netflow
Create a Flow Template and Define the Fields to Export

You can can also try using the pre-defined NetFlow template.

# show flow record netflow-original
Flow record netflow-original:
    Description: Traditional IPv4 input NetFlow with origin ASs
    No. of users: 1
    Template ID: 261
    Fields:
         match ipv4 source address
         match ipv4 destination address
         match ip protocol
         match ip tos
         match transport source-port
         match transport destination-port
         match interface input
         match interface output
         match flow direction
         collect routing source as
         collect routing destination as
         collect routing next-hop address ipv4
         collect transport tcp flags
         collect counter bytes
         collect counter packets
         collect timestamp sys-uptime first
         collect timestamp sys-uptime last
Set up NetFlow Exporter

Run these commands.

flow exporter FortiSIEMFlowAnalyzer
description export netflow to FortiSIEM
destination <FortiSIEMIp>export Version 9
transport udp 2055
source vlan613
Associate the Record to the Exporter Using a Flow Monitor

In this example the flow monitor is called FortiSIEMMonitoring.

Run these commands. 

flow monitor FortiSIEMMonitoring
exporter FortiSIEMFlowAnalyzer
record netflow-original
Apply the Flow Monitor to Every Interface

Run these commands.

interface Vlan612
ip flow monitor Monitortac7000 input
exit
interface Vlan613
ip flow monitor Monitortac7000 input
exit

You can now check the configuration using the show commands. 

Settings for Access Credentials

For SNMP, Telnet, and SSH access credentials, see Access Credentials.