Cisco NX-OS Router and Switch

• What is Discovered and Monitored
• Event Types
• Rules
• Reports
• Configuration
• Settings for Access Credentials

What is Discovered and Monitored

Protocol	Information Discovered	Metrics collected	Used for
SNMP (V1, V2c, V3)	Host name, IOS version, Hardware model, Memory size, Network interface details - name, address, mask and description	Uptime, CPU and Memory utilization, Free processor and I/O memory, Free contiguous processor and I/O memory, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)	Availability and Performance Monitoring
SNMP (V1, V2c, V3)	Hardware component details: serial number, model, manufacturer, software and firmware versions of hardware components such as chassis, CPU, fan, power supply, network cards etc.	Hardware health: temperature, fan and power supply	Availability
SNMP (V1, V2c, V3)	Trunk port connectivity between switches and VLANs carried over a trunk port (via CDP MIB), ARP table		Topology and end-host location
SNMP (V1, V2c, V3)	BGP connectivity, neighbors, state, AS number	BGP state change	Routing Topology, Availability Monitoring
SNMP (V1, V2c, V3)	OSPF connectivity, neighbors, state, OSPF Area	OSPF state change	Routing Topology, Availability Monitoring
SNMP (V1, V2c, V3)		Class based QoS metrics: For (router interface, policy, class map) tuple: class map metrics including Pre-policy rate, post-police rate, drop rate and drop pct; police action metrics including conform rate, exceeded rate and violated rate; queue metrics including current queue length, max queue length and discarded packets	QoS performance monitoring
Telnet/SSH	Running and startup configuration, Image file name, Flash memory size, Running processes	Startup configuration change, delta between running and startup configuration, Running process CPU and memory utilization	Performance Monitoring, Security and Compliance
Telnet/SSH	End host Layer 2 port mapping: switch interface to VLAN id, end host IP/MAC address association
Syslog	Device type>	System logs and traffic logs matching acl statements	Availability, Security and Compliance

Event Types

In ADMIN > Device Support > Event Types, search for "cisco-nxos" to see the event types associated with this device.

Rules

There are no predefined rules for this device.

Reports

There are no predefined reports for this device.

Configuration

• SNMP

• Telnet/SSH

• Syslog

• NetFlow

SNMP

FortiSIEM uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.

Telnet/SSH

FortiSIEM uses Telnet/SSH to communicate with this device. Refer to the product documentation for your device to enable Telnet/SSH.

These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in FortiSIEM have the permissions necessary to execute these commands on the device.

• show startup-config
• show running-config
• show version
• show flash
• show context
• show ip route
• show cam dynamic
• show mac-address-table
• show mac address-table (for Nexus 1000v)
• show vlan brief
• show process cpu
• show process mem
• show disk0
• enable
• terminal length 0

Syslog

FortiSIEM processes events from this device via syslog sent by the device. Configure the device to send syslog to FortiSIEM as directed in the device's product documentation, and FortiSIEM will parse the contents.

• For Syslog Server, or the server where the syslog should be sent, enter the IP address of your FortiSIEM virtual appliance.
• For Port, enter 514.
• Make sure that the syslog type is Common Event Format (CEF). The syslog format should be the same as that shown in the example.

NetFlow

• Enable NetFlow on the Router

• Create a Flow Template and Define the Fields to Export

• Set up NetFlow Exporter

• Associate the Record to the Exporter Using a Flow Monitor

• Apply the Flow Monitor to Every Interface

Enable NetFlow on the Router

1. Enter configuration mode.
2. Run this command.

   feature netflow

Create a Flow Template and Define the Fields to Export

You can can also try using the pre-defined NetFlow template.

# show flow record netflow-original
Flow record netflow-original:
    Description: Traditional IPv4 input NetFlow with origin ASs
    No. of users: 1
    Template ID: 261
    Fields:
         match ipv4 source address
         match ipv4 destination address
         match ip protocol
         match ip tos
         match transport source-port
         match transport destination-port
         match interface input
         match interface output
         match flow direction
         collect routing source as
         collect routing destination as
         collect routing next-hop address ipv4
         collect transport tcp flags
         collect counter bytes
         collect counter packets
         collect timestamp sys-uptime first
         collect timestamp sys-uptime last

Set up NetFlow Exporter

Run these commands.

flow exporter FortiSIEMFlowAnalyzer
description export netflow to FortiSIEM
destination <FortiSIEMIp>export Version 9
transport udp 2055
source vlan613

Associate the Record to the Exporter Using a Flow Monitor

In this example the flow monitor is called FortiSIEMMonitoring.

Run these commands.

flow monitor FortiSIEMMonitoring
exporter FortiSIEMFlowAnalyzer
record netflow-original

Apply the Flow Monitor to Every Interface

Run these commands.

interface Vlan612
ip flow monitor Monitortac7000 input
exit
interface Vlan613
ip flow monitor Monitortac7000 input
exit

You can now check the configuration using the show commands.

Settings for Access Credentials

For SNMP, Telnet, and SSH access credentials, see Access Credentials.