The VRF Aware System Message Logging (Syslog) feature allows a router to send system logging (syslog) messages to a syslog server host connected through a Virtual Private Network (VPN) routing and forwarding (VRF) interface.
You can use logging information for network monitoring and troubleshooting. This feature extends this capability to network traffic connected through VRFs.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for VRF Aware System Message Logging
You must configure a VRF on a routing device and associate the VRF with an interface (see Associating a VRF with an Interface) before you can configure the VRF Aware System Message Logging feature.
Restrictions for VRF Aware System Message Logging
You cannot specify a source address for VRF system logging messages. The VRF Aware System Message Logging feature uses the VRF interface address as the source address for all VRF-aware system logging messages.
Information About VRF Aware System Message Logging
A VPN routing and VRF instance is an extension of IP routing that provides multiple routing instances. A VRF provides a separate IP routing and forwarding table to each VPN. You must configure a VRF on a routing device before you configure the VRF Aware System Message Logging feature.
After you configure the VRF Aware System Message Logging feature on a routing device, the device can send syslog messages to a syslog host through a VRF interface. Then you can use logging messages to monitor and troubleshoot network traffic connected through a VRF. Without the VRF Aware System Message Logging feature on a routing device, you do not have this benefit; the routing device can send syslog messages to the syslog host only through the global routing table.
You can receive system logging messages through a VRF interface on any router where you can configure a VRF, that is:
On a provider edge (PE) router that is used with Multiprotocol Label Switching (MPLS) and multiprotocol Border Gateway Protocol (BGP) to provide a Layer 3 MPLS VPN network service.
On a customer edge (CE) device (switch or router) that is configured for VRF-Lite, which is a VRF implementation without multiprotocol BGP.
VRF Aware System Message Logging on a Provider Edge Router in an MPLS VPN Network
You can configure the VRF Aware System Message Logging feature on a PE router in a Layer 3 MPLS VPN network. The PE router can then send syslog messages through a VRF interface to a syslog server located in the VPN.
The figure below shows an MPLS VPN network and the VRF Aware System Message Logging feature configured on a PE router associated with VRF VPN1. The PE router sends log messages through a VRF interface to a syslog server located in VPN1. You can display the messages from the syslog server on a terminal.
Figure 1
MPLS VPN and VRF Aware System Message Logging Configured on a Customer Edge Router
VRF Aware System Message Logging on a Customer Edge Device with VRF-Lite Configured
You can configure the VRF Aware System Message Logging feature on a CE device where you have configured the VRF-Lite feature. The CE device can then send syslog messages through a VRF interface to syslog servers in multiple VPNs. The CE device can be either a router or a switch.
The figure below shows the VRF Aware System Message Logging feature configured on a VRF-Lite CE device. The CE device can send VRF syslog messages to syslog servers in VPN1 or VPN2 or to servers in both VPN1 and VPN2. You can configure multiple VRFs on a VRF-Lite CE device, and the device can serve many customers.
Figure 2
VRF Aware System Message Logging Configured on a VRF-Lite Customer Edge Device
Message Levels for Logging Commands
The table below lists message levels for
logging commands that you can use when you configure the VRF Aware System Message Logging feature. Information provided by the table below includes keyword level names and numbers, their description, and the associated syslog definitions. You can use either the level keyword name or number with the
logging traplevel and
logging bufferedseverity-level commands.
Table 1
Message Levels for logging Commands
Level Name
Level Number
Description
Syslog Definition
emergencies
0
System unusable
LOG_EMERG
alerts
1
Immediate action needed
LOG_ALERT
critical
2
Critical conditions
LOG_CRIT
errors
3
Error conditions
LOG_ERR
warnings
4
Warning conditions
LOG_WARNING
notifications
5
Normal but significant condition
LOG_NOTICE
informational
6
Informational messages only
LOG_INFO
debugging
7
Debugging messages
LOG_DEBUG
How to Configure and Verify VRF Aware System Message Logging
Configuring a VRF on a routing device helps provides customer connectivity to a VPN. The routing device can be a PE router connected to an MPLS VPN network or a CE (switch or router) that is configured for VRF-Lite.
The
vrf-nameargument is a name assigned to the VRF.
Step 4
rdroute-distinguisher
Example:
Router(config-vrf)# rd 100:1
Creates routing and forwarding tables for a VRF.
The
route-distinguisher argument adds an 8-byte value to an IPv4 prefix to create a VPN IPv4 prefix.
The route distinquisher (RD) is either an autonomous system number (ASN)-relative RD, in which case it is composed of an autonomous system number and an arbitrary number, or it is an IP-address-relative RD, in which case it is composed of an IP address and an arbitrary number.
You can enter an RD in either of these formats:
16-bit autonomous system number: your 32-bit number For example, 101:3.
32-bit IP address: your 16-bit number For example, 10.0.0.1:1.
Creates a route-target extended community for a VRF.
The
import keyword imports routing information from the target VPN extended community.
The
export keyword exports routing information to the target VPN extended community.
The
both keyword imports routing information from and exports routing information to the target VPN extended community.
The
route-target-ext-community argument adds the route-target extended community attributes to the VRF's list of import, export, or both (import and export) route-target extended communities.
The route target specifies a target VPN extended community. Like a route distinguisher, an extended community is composed of either an autonomous system number and an arbitrary number or an IP address and an arbitrary number. You can enter the numbers in either of these formats:
16-bit autonomous system 1 32-bit number For example, 101:3.
32-bit IP address: your 16-bit number For example, 10.0.0.2.15: 1.
Step 6
end
Example:
Router(config-vrf)# end
Exits to privileged EXEC mode.
Associating a VRF with an Interface
Perform this task to associate a VRF instance with an interface. A VRF must be associated with an interface before you can forward VPN traffic.
Note
You cannot configure a source address for VRF system logging messages. The VRF Aware System Message Logging feature uses the VRF interface address as the source address for all VRF-aware system logging messages.
After configuring the VRF and associating it with an interface, you can configure the VRF Aware System Message Logging feature on the routing device.
SUMMARY STEPS
1.enable
2.configure terminal
3.interfacetypenumber
4.ip vrf forwardingvrf-name
5.end
6.copy running-config startup-config
DETAILED STEPS
Command or Action
Purpose
Step 1
enable
Example:
Router> enable
Enables privileged EXEC mode.
Enter your password if prompted.
Step 2
configure terminal
Example:
Router# configure terminal
Enters global configuration mode.
Step 3
interfacetypenumber
Example:
Router(config)# interface FastEthernet 0/0
Configures an interface type and enters interface configuration mode.
The
type argument is the type of interface to be configured.
The
number argument is the port, connector, or interface card number. On Cisco 4700 series routers, it specifies the network interface module (NIM) or network processor module (NPM) number. The numbers are assigned at the factory at the time of installation or when the port, connector, or interface card is added to a system, and can be displayed with the
show interfaces command.
Step 4
ip vrf forwardingvrf-name
Example:
Router(config-if)# ip vrf forwarding vpn1
Associates a VRF with an interface or subinterface.
The
vrf-name argument associates the interface with the specified VRF.
Step 5
end
Example:
Router(config-if)# end
Exits to privileged EXEC mode.
Step 6
copy running-config startup-config
Example:
Router# copy running-config startup-config
(Optional) Saves configuration changes to NVRAM.
Configuring VRF Aware System Message Logging on a Routing Device
Configure the VRF Aware System Message Logging feature on a routing device so that logging messages can be used to monitor and troubleshoot network traffic connected through VRF instances.
Before You Begin
You must perform the following tasks before you perform this task:
The
ip-address argument is the IP address of the syslog server host.
The
hostname argument is the name of the IP or IPv6 host that receives the syslog messages.
The
vrfvrf-name keyword argument pair specifies a VRF that connects to the syslog server host.
Step 4
logging traplevel
Example:
Router(config)# logging trap debugging
Limits messages logged to the syslog servers based on severity.
The
level argument limits the logging of messages to the syslog servers to a specified level. You can enter the level number or level name. See the "Message Levels for Logging Commands" section for a description of acceptable keywords.
Step 5
logging facilityfacility-type
Example:
Router(config)# logging facility local6
(Optional) Configures the syslog facility in which error messages are sent.
The
facility-type argument names the syslog facility type keyword. For locally defined messages, the range of acceptable keywords is local0 to local7. The default is
local7.
Step 6
logging buffered [buffer-size |
severity-level]
Example:
Router(config)# logging buffered debugging
(Optional) Limits messages logged to an internal buffer on the router based on severity.
Thebuffer-size argument is the size of the buffer from 4096 to 4,294,967,295 bytes. The default size varies by platform.
The
severity-level argument limits the logging of messages to the buffer to a specified level. You can enter the level name or level number. See the "Message Levels for Logging Commands" section for a list of the acceptable level name or level number keywords. The default logging level varies by platform, but is generally 7, meaning that messages at all levels (0-7) are logged to the buffer.
Step 7
end
Example:
Router(config)# end
(Optional) Exits to privileged EXEC mode.
Verifying VRF Aware System Message Logging Operation
SUMMARY STEPS
1.enable
2.show running-config | include logging
3.show ip vrf interfaces
4.show running-config [interfacetypenumber]
5.ping vrfvrf-nametarget-ip-address
6.exit
DETAILED STEPS
Step 1
enable
Use this command to enable privileged EXEC mode. You can also enter this command in user EXEC mode. Enter your password if prompted. For example:
Example:
Router> enable
Router#
Step 2
show running-config | include logging
Use this command to display the logging configuration for the router and the logging host for a VRF. For example:
This example shows the configuration of a syslog server in VRF vpn1 with a server host address of 10.0.0.3.
Step 3
show ip vrf interfaces
Use this command to display the interfaces associated with the VRF that links to a syslog server host. The following example displays a list of VRF interfaces and their associated IP addresses that are configured on the router:
Example:
Router# show ip vrf interfaces
Interface IP-Address VRF Protocol
FastEthernet0/0/0 10.0.0.0 vpn1 up
Loopback1 10.0.0.6 vpn1 up
Step 4
show running-config [interfacetypenumber]
Use this command to display interface specific configuration information for an interface associated with a VRF. For example:
Example:
Router# show running-config interface FastEthernet 0/0/0
Building configuration...
Router#
.
.
.
!
Current configuration : 116 bytes
!
interface FastEthernet0/0/0
ip vrf forwarding vpn1
ip address 10.0.0.98 255.0.0.0
duplex half
no cdp enable
end
This example displays configuration information for Fast Ethernet interface 0/0/0 in VRF vpn1.
Step 5
ping vrfvrf-nametarget-ip-address
Use this command to verify that you can reach the syslog server host, the
target-ip-address, through the specified VRF. For example:
Example:
Router# ping vrf vpn1 10.3.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.3.0.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms
In this example, the syslog server has an IP address of 10.3.0.1 and the VRF is named vpn1. The server is reached successfully four of five times.
Step 6
exit
Use this command to exit privileged EXEC mode. For example:
Example:
Router# exit
Router>
Configuration Examples for VRF Aware System Message Logging
enable
configure terminal
!
ip vrf vpn1
rd 100:1
route-target both 100:1
end
Example Associating a VRF with an Interface
enable
configure terminal
!
interface FastEthernet 0/0/0
ip vrf forwarding vpn1
end
Example Configuring VRF Aware System Message Logging on a Routing Device
The following example shows how to configure the VRF Aware System Message Logging feature on a routing device. The IP address of the syslog server host is 10.0.1.3 and the VRF is vpn1.
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
--
Technical Assistance
Description
Link
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.
To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.
Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.
Feature Information for VRF Aware System Message Logging
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 2
Feature Information for VRF Aware System Message Logging
Feature Name
Releases
Feature Information
VRF Aware System Message Logging (Syslog)
12.4(4)T
12.2(33)SRA
12.2(31)SB2
12.4(13)
12.2(33)SXH
The VRF Aware System Message Logging feature allows a router to send syslog messages to a syslog server host connected through a VPN VRF interface.
In 12.4(4)T, this feature was introduced.
In 12.2(33)SRA, this feature was integrated.
In 12.2(31)SB2, support was added for the Cisco 10000 series routers.
In 12.4(13), this feature was integrated.
In 12.2(33)SXH, this feature was integrated. The following command was modified by this feature:
logging host.
Glossary
CErouter--customer edge router. A router on the border between a VPN provider and a VPN customer that belongs to the customer.
LSR--label switching router. A device that forwards MPLS packets based on the value of a fixed-length label encapsulated in each packet.
MPLS--Multiprotocol Label Switching. A method for forwarding packets (frames) through a network. It enables routers at the edge of a network to apply labels to packets (frames). ATM switches or existing routers in the network core can switch packets according to the labels with minimal lookup overhead.
MPLSVPN--Multiprotocol Label Switching Virtual Private Network. An IP network infrastructure delivering private network services over a public infrastructure using a Layer 3 backbone. Using MPLS VPNs in a Cisco network provides the capability to deploy and administer scalable Layer 3 VPN backbone services including applications, data hosting network commerce, and telephony services to business customers.
PErouter--provider edge router. A router on the border between a VPN provider and a VPN customer that belongs to the provider.
VPN--Virtual Private Network. A group of sites that, as the result of a set of administrative policies, are able to communicate with each other over a shared backbone network. A VPN is a secure IP-based network that shares resources on one or more physical networks. A VPN contains geographically dispersed sites that can communicate securely over a shared backbone.
Seealso MPLS VPN.
VRF--VPN routing and forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.