%PIX-4-410001: Dropped UDP DNS reply from outside:x.x.x.x/53 to

inside:y.y.y.y/49746; packet length 768 bytes exceeds configured limit of 512

I was wondering what might be the reason, then figured out the packets received from ISP is of 768 bytes whereas by default the Cisco PIX 525 Firewall allows 512 bytes as shown below.

The problem was with the default DNS inspection policy-map. By default in Cisco PIX 525, Cisco ASA it’s configured to 512 bytes

The moment I changed the default DNS inspection policy-map from 512 bytes to 1000 bytes things were normal the Windows 2008 R2 Server was resolving the DNS queries.

The commands I used to change the default DNS inspection policy-map is as follows.

MBGF-DAC-525-FW01# configure t

MBGF-DAC-525-FW01(config)# class-map inspection_default

MBGF-DAC-525-FW01(config-cmap)# match default-inspection-traffic

MBGF-DAC-525-FW01(config-cmap)# policy-map global_policy

MBGF-DAC-525-FW01(config-pmap)# class inspection_default

MBGF-DAC-525-FW01(config-pmap-c)# inspect dns maximum-length 1000

MBGF-DAC-525-FW01(config-pmap-c)#

We all know the importance of logs generated by Cisco Devices. Since long time I am using Kiwi Syslog server to capture the log generated by the Cisco Devices installed in our network. Recently Solar Winds announced the release of Kiwi Syslog Server. Since I was using an old version I downloaded the latest full trail version of Kiwi Syslog Server version 9. In the new version I found some new cool features which are really useful for Network Administrators.

Pic Courtesy: Solar Winds

With new Kiwi Syslog Server you can access the Syslog data from anywhere on the network using the web access this feature is amazing as its easy for me to look at logs periodically no matter where I am.

Some of the key features of Kiwi Syslog Server v9 are as follows.

• View your syslog data from anywhere on the network via web access – NEW FEATURE!
• Filter messages and create advanced alerts with Advanced Script Processing
• Log to any database with ODBC logging
• Schedule archiving and log maintenance by using Automated Log Archive
• View syslog messages in multiple windows simultaneously
• Automatically perform actions based on alerts, including sending email, forwarding messages, triggering audible alarms, sending SNMP trap messages, and paging IT staff
• Retain the original source IP on forwarded messages as one of many advanced forwarding options
• Forward Windows event log messages from your Windows servers to your Kiwi Syslog Server using the included Log Forwarder for Windows – NEW FEATURE!
• Produce trend analysis graphs and email syslog traffic statistics
• Leverage and share user-created rules, filters and scripts with the Community Content Exchange on thwack – NEW FEATURE!

With new Kiwi Syslog Server v9 my day to day activity is somewhat simplified as I can create filters based on host name, IP address or even event based. I just don’t need to look at each and every log.  It does saves lot of time.

For sure you must try the new Kiwi Syslog Server. It does comes in two versions a free one and a full version with lot features.

SolarWinds announced on 5^th of Jan09, it had acquired for an undisclosed sum the assets of New Zealand-based software maker Kiwi Enterprises, best known for its free management and configuration tools.

Picture Courtesy: Solar Winds.

SolarWinds, also known for making freeware versions of its enterprise software available, acquired Kiwi with plans to incorporate the company’s Syslog and CatTools products into its own Orion platform.

“We saw a number of similarities in the products and communities of Kiwi Enterprises and SolarWinds, and expect this acquisition to generate immediate benefit, not only to our respective customer bases, but to the IT community at large,” said Michael S. Bennett, chairman and CEO, SolarWinds. “SolarWinds is committed to delivering deep value to network engineers by addressing their everyday pain, simply and affordably.”SolarWinds will add the Kiwi products, specifically Kiwi Syslog Server and Kiwi CatTools, to its popular line-up of tools for network engineers.  In addition, SolarWinds also expects to use the other software products that it purchased to expand its free tool offerings.

For more details do check the press release from Solar Winds.

[kml_flashembed movie="http://www.youtube.com/v/8DxAOm4QSZ8" width="425" height="350" wmode="transparent" /]

By default  on Cisco IOS , no timestamp information is included; however, you can enable timestamps and also modify the format of the timestamp attached to SYSLOG message by using the service timestamps log global configuration commands as follows:

ITKE(Config)# service timestamps log {uptime |datetime [msec |localtime |show-timezone]}

I will demonstrate how to configure a Cisco IOS Switch to log the datetime and loclatime.

Before Configuring the service timestamps log you will get the following logs in a IOS Switch.

ITKE#sho log

Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

   Console logging: level debugging, 453895 messages logged, xml disabled,

                     filtering disabled

    Monitor logging: level debugging, 0 messages logged, xml disabled,

                     filtering disabled

    Buffer logging:  level debugging, 453895 messages logged, xml disabled,

                    filtering disabled

    Exception Logging: size (4096 bytes)

    Count and timestamp logging messages: disabled

    File logging: disabled

    Persistent logging: disabled

    Trap logging: level informational, 453898 message lines logged

        Logging to 10.0.0.2  (udp port 514,  audit disabled,

              authentication disabled, encryption disabled, link up),

              453898 message lines logged,

              0 message lines rate-limited,

              0 message lines dropped-by-MD,

              xml disabled, sequence number disabled

              filtering disabled

        Logging to 10.0.0.1  (udp port 514,  audit disabled,

              authentication disabled, encryption disabled, link up),

              453898 message lines logged,

              0 message lines rate-limited,

              0 message lines dropped-by-MD,

              xml disabled, sequence number disabled

              filtering disabled

          Log Buffer (4096 bytes):

17w5d: %LINK-3-UPDOWN: Interface GigabitEthernet0/41, changed state to down

17w5d: %LINK-3-UPDOWN: Interface GigabitEthernet0/41, changed state to up

17w5d: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/41, changed state to up

17w5d: %SEC-6-IPACCESSLOGP: list 102 permitted tcp 10.0.0.6(49336) -> 0.0.0.0(23), 1 packet

Now we will configure the Cisco IOS Switch with the Service timestamp log command with date & local time of the Switch by issuing the following command from the global configuration mode. 

ITKE(config)#service timestamps log datetime localtime

Here are the details of log show in the switch after configuring the service timestamps log command

ITKE#sho log

Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

    Console logging: level debugging, 454006 messages logged, xml disabled,

                     filtering disabled

    Monitor logging: level debugging, 0 messages logged, xml disabled,

                     filtering disabled

    Buffer logging:  level debugging, 454006 messages logged, xml disabled,

                    filtering disabled

    Exception Logging: size (4096 bytes)

    Count and timestamp logging messages: disabled

    File logging: disabled

    Persistent logging: disabled

    Trap logging: level informational, 454009 message lines logged

        Logging to 10.0.0.2  (udp port 514,  audit disabled,

              authentication disabled, encryption disabled, link up),

              454009 message lines logged,

              0 message lines rate-limited,

              0 message lines dropped-by-MD,

              xml disabled, sequence number disabled

              filtering disabled

        Logging to 10.0.0.1  (udp port 514,  audit disabled,

              authentication disabled, encryption disabled, link up),

              454009 message lines logged,

              0 message lines rate-limited,

              0 message lines dropped-by-MD,

              xml disabled, sequence number disabled

              filtering disabled

Log Buffer (4096 bytes):

Aug 20 09:10:48: %LINK-3-UPDOWN: Interface GigabitEthernet0/13, changed state to up

Aug 20 09:10:49: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/13, changed state to up

Aug 20 09:10:55: %SYS-5-CONFIG_I: Configured from console by yasir on vty2 (10.0.0.6)

Aug 20 09:11:19: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/13, changed state to down

Aug 20 09:11:20: %LINK-3-UPDOWN: Interface GigabitEthernet0/13, changed state to down

Aug 20 09:11:22: %SEC-6-IPACCESSLOGP: list 102 permitted tcp 10.0.0.1(44420) -> 0.0.0.0(23), 1 packet

Aug 20 09:11:23: %LINK-3-UPDOWN: Interface GigabitEthernet0/13, changed state to up

Aug 20 09:11:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/13, changed state to up

Aug 20 09:11:37: %SEC-6-IPACCESSLOGP: list 102 permitted tcp 10.0.0.6(49493) -> 0.0.0.0(23), 1 packet

ITKE#