Configure Syslog over TLS

Step-by-Step Procedure

The following procedure requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure the device:

1. Specify the syslog server that receives the system log messages. You can specify the IP address of the syslog server or a fully qualified hostname. In this example, use 10.102.70.233 as the IP address of the syslog server.

   content_copy zoom_out_map

   [edit]
   user@host# set system syslog host 10.102.70.223 any any

2. Specify the port number of the syslog server.

   content_copy zoom_out_map

   [edit]
   user@host# set system syslog host 10.102.70.223 port 10514

3. Specify the syslog transport protocol for the device. In this example, use TLS as the transport protocol.

   content_copy zoom_out_map

   [edit]
   user@host# set system syslog host 10.102.70.223 transport tls 

4. Specify the name of the trusted certificate authority (CA) group or specify the name of the CA profile to be used. In this example, use example-ca as the CA profile.

   content_copy zoom_out_map

   [edit]
   user@host# set system syslog host 10.102.70.223 tlsdetails trusted-ca-group trusted-ca-group-name ca-profiles example-ca

5. Configure the device to send all log messages.

   content_copy zoom_out_map

   [edit]
   user@host# set system syslog file messages any any

6. Commit the configuration.

   content_copy zoom_out_map

   [edit]
   user@host# commit

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set security log mode stream
set security log format sd-syslog
set security log source-interface ge-0/0/1.0
set security log transport protocol tls
set security log transport tls-profile ssl-i-tls
set security log stream server1 format sd-syslog
set security log stream server1 category all
set security log stream server1 host 192.0.2.100
set services ssl initiation profile ssl-i-tls protocol-version all
set services ssl initiation profile ssl-i-tls trusted-ca all
set services ssl initiation profile ssl-i-tls actions ignore-server-auth-failure

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure the TLS syslog protocol:

1. Set the log mode to stream.

   content_copy zoom_out_map

   [edit security]
   user@host# set log mode stream
   

2. Specify the structured system log (sd-syslog) format for remote security message logging .

   content_copy zoom_out_map

   [edit security]
   user@host# set log format sd-syslog
   

3. Set the host source interface number.

   content_copy zoom_out_map

   [edit security]
   user@host# set log source-interface ge-0/0/1.0
   

4. Specify TLS as the security log transport protocol to be used to log the data.

   content_copy zoom_out_map

   [edit security]
   user@host# set log transport protocol tls
   

5. Specify the TLS profile name.

   content_copy zoom_out_map

   [edit security]
   user@host# set log transport tls-profile ssl-i-tls
   

6. Set the log stream to use the structured syslog format for sending logs to server 1.

   content_copy zoom_out_map

   [edit security]
   user@host# set log stream server1 format sd-syslog
   

7. Set the category of server 1 logging to all.

   content_copy zoom_out_map

   [edit security]
   user@host# set log stream server1 category all
   

8. Specify server host parameters by entering the server name or IP address.

   content_copy zoom_out_map

   [edit security]
   user@host# set log stream server1 host 192.0.2.100
   

9. Define the protocol version all for the SSL initiation access profile.

   content_copy zoom_out_map

   [edit services]
   user@host# set ssl initiation profile ssl-i-tls protocol-version all
   

10. Attach all CA profile groups to the SSL initiation profile to use when requesting a certificate from the peer.

    content_copy zoom_out_map

    [edit services]
    user@host# set ssl initiation profile ssl-i-tls trusted-ca all
    

11. Configure the SSL initiation access profile to ignore the server authentication failure.

    content_copy zoom_out_map

    [edit services]
    user@host# set ssl initiation profile ssl-i-tls actions ignore-server-auth-failure
    

Results

In configuration mode, verify your configuration by using the show security log command. If the output does not display the intended configuration, then repeat the configuration instructions in this example to correct it.

[edit]
user@host# show security log
    mode stream;
        format sd-syslog;
        source-interface ge-0/0/1.0;
        transport {
            protocol tls;
            tls-profile ssl-i-tls;
        }
        stream server1 {
            format sd-syslog;
            category all;
            host {
            192.0.2.100;
            }
        }
    }

[edit]
user@host# run show configuration services ssl initiation
    profile ssl-i-tls {
        protocol-version all;
        trusted-ca all;
        actions {
            ignore-server-auth-failure;
        }
    }

If you are done configuring the device, enter commit from configuration mode.