Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Configure Syslog over TLS

SUMMARY Learn how to configure your device to transport system log messages (also known as syslog messages) securely over the Transport Layer Security (TLS) protocol.

Control Plane Logs

Control plane logs, also called system logs, include events that occur on the routing platform. The system sends control plane events to the eventd process on the Routing Engine, which then handles the events by using Junos OS policies, by generating system log messages, or by doing both. You can choose to send control plane logs to a file, user terminal, routing platform console, or remote machine. To generate control plane logs, use the syslog statement at the [system] hierarchy level.

Example: Configure Syslog over TLS

This example shows how to configure a Juniper Networks device to transport syslog messages (control plane logs) securely over TLS.

Requirements

This example uses the following hardware and software components:

  • Junos OS Release 21.2R1 or later

  • Junos OS Evolved Release 23.4R1 or later

  • Device running Junos OS or Junos OS Evolved (syslog client)

  • Syslog server

Overview

You use the TLS protocol to enable secure transportation of system log messages (control plane logs) from the syslog client to the syslog server. TLS uses certificates to authenticate and encrypt the communication.

  • Server authentication (or one-way TLS)—Client verifies the identify of the server and trusts the server.
  • Mutual authentication—Both the server and client trust each other.

You can choose either server authentication or mutual authentication depending on your network. To quickly access the information you need, click the links in Table 1.

Table 1: TLS Authentication Modes

Authentication Mode

Procedure

Section Where the Information Is Located

Server authentication

Configure PKI

Configure the device

Server Authentication

Configuration

In the following example, we use the TLS protocol to securely transport syslog messages (control plane logs) from the Juniper device to the remote syslog server. Figure 1 shows the basic topology used in this example.

Figure 1: Syslog over TLSSyslog over TLS
Public Key Infrastructure (PKI) Configuration Overview

To configure PKI on the device:

  1. Create a certification authority (CA) profile, and associate a CA identifier with the CA profile. See Example: Configuring a CA Profile.
  2. (Optional) Create a revocation check to specify a method for validating the certificate. You can use either certificate revocation lists (CRLs) or the Online Certificate Status Protocol (OCSP). See Certificate Revocation.
  3. (Optional) Create a trusted CA group, and add the CA profile to the trusted group. See Configuring a Trusted CA Group.
  4. Load the CA certificate on the device. You can load the certificate manually. See Example: Loading CA and Local Certificates Manually. Based on your deployment environment, you can use either Certificate Management Protocol version 2 (CMPv2) or Simple Certificate Enrollment Protocol (SCEP) for online certificate enrollment. See Enrolling a CA Certificate Online Using SCEP and Understanding Certificate Enrollment with CMPv2.
  5. (Optional for mutual authentication) Load the local certificate on the device. You can load the local certificate manually. Based on your deployment environment, you can use either CMPv2 or SCEP for online certificate enrollment. See Enrolling a Local Certificate Online Using SCEP and Understanding Certificate Enrollment with CMPv2.
  6. Verify that the certificates are loaded successfully. Use the request security pki ca-certificate verify command to check whether the CA certificate has loaded successfully. Use the request security pki local-certificate verify command to verify that the local certificate has loaded successfully.
Configure Server Authentication on Your Device
Step-by-Step Procedure

The following procedure requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure the device:

  1. Specify the syslog server that receives the system log messages. You can specify the IP address of the syslog server or a fully qualified hostname. In this example, use 10.102.70.233 as the IP address of the syslog server.

  2. Specify the port number of the syslog server.

  3. Specify the syslog transport protocol for the device. In this example, use TLS as the transport protocol.

  4. Specify the name of the trusted certificate authority (CA) group or specify the name of the CA profile to be used. In this example, use example-ca as the CA profile.

  5. Configure the device to send all log messages.

  6. Commit the configuration.

Results

In configuration mode, confirm your configuration by using the show system syslog command.

Verification

To verify that the configuration is working properly, enter the show log command on the syslog server.

See Also

Data Plane Logs

Data plane logs, also called security logs, include security events that are handled inside the data plane. Security logs can be in text or binary format, and you can save them locally (event mode) or configure your device to send the logs to an external server (stream mode). You require binary format for stream mode. We recommend binary format to conserve log space in event mode.

Example: Configure the TLS Syslog Protocol on SRX Series Firewalls

This example shows how to configure the Transport Layer Security (TLS) syslog protocol on SRX Series Firewalls to receive encrypted syslog events from network devices that support TLS syslog event forwarding.

Requirements

Before you begin, enable server certificate verification and encryption or decryption capabilities.

Overview

The TLS syslog protocol enables a log source to receive encrypted syslog events from network devices that support TLS syslog event forwarding. The log source creates a listen port for incoming TLS syslog events and generates a certificate file for the network devices.

In this example, you configure a syslog collector associated with one SSL-I profile. Each SSL-I profile enables the user to specify things such as preferred ciphers suite and trusted CA certificates. You can configure multiple SSL-I profiles and associate the profiles with different collector servers.

Configuration

Procedure
CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure the TLS syslog protocol:

  1. Set the log mode to stream.

  2. Specify the structured system log (sd-syslog) format for remote security message logging .

  3. Set the host source interface number.

  4. Specify TLS as the security log transport protocol to be used to log the data.

  5. Specify the TLS profile name.

  6. Set the log stream to use the structured syslog format for sending logs to server 1.

  7. Set the category of server 1 logging to all.

  8. Specify server host parameters by entering the server name or IP address.

  9. Define the protocol version all for the SSL initiation access profile.

  10. Attach all CA profile groups to the SSL initiation profile to use when requesting a certificate from the peer.

  11. Configure the SSL initiation access profile to ignore the server authentication failure.

Results

In configuration mode, verify your configuration by using the show security log command. If the output does not display the intended configuration, then repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

To verify that the configuration is working properly, enter the show log command on the syslog server.