Pix FW... multiple IP's

Question

Couldn't find an answer to this...

One of the firewalls I monitor is giving me grief... it has a management IP (let's say, 151.1) that Orion uses for monitoring, but because we have a syslog server (for all cisco devices), the syslogs are generated from a different IP (200.254).

Solarwinds Syslog Viewer handles this fine, and accepts and displays the syslog messages just fine from 200.254, and displays them along with all the other syslog messages coming in.  I'm good with that.

In Orion, though, we need to be able to view the syslogs from individual machines, and I cannot do this to see the PIX (151.1).  If I "view all", I'm fine, but for troubleshooting, the Service Desk will need to be able to view the syslog of just the PIX without the noise of all other syslogs.

The question, then... is there a way in NPM to alias a second IP to an existing node?  Or any other way to do what I describe?  Much obliged.

sedmo · Answer

Could you possibly use source commands on the switch to specify that traps and logging get sent from the same interface (example below)?

logging source-interface Loopback0
snmp-server trap-source Loopback0

AlbanyMike · Answer

I am running into the same problem.  Orion is our syslog server.  I have a core switch with multiple IPs.  It sends its syslog stuff over VLAN1 which ahs a 172.x.x.x IP.  It sends it traps to Orion using GI0/0 which has a 10.x.x.x IP.  The switch was discovered using its 172 IP and has no problme displaying, or filtering for those syslogs.  The problme is with the traps.  The Orion website will not even display them.  The Orion server trap viewer will display them, but does not associate it with any hostname, therefore, the only way to filter is by source IP, and it can only be done on the server, not the website.

Please Help!

I have added the node a second time, with its 2nd IP with is an extrememly messy workaround.  Is there anyway for one device to be associated with 2 IPs from an Orion perspective?

Thanks!

Josh_Stephens · Answer

I'm not certain that I'm understanding you correctly. Are you saying that you have a central Syslog server that all of your Cisco devices send their logs to and then it's forwarding messages to your Orion server?

If so, a good workaround might be to add Orion's IP Address as a second Syslog destination within your router configs so that Orion receives the logs directly.

Thanks,
Josh Stephens
SolarWinds