Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am struggling to get my Cisco device to send syslog data to a remote server running behind a VPN tunnel. syslog IP on the remote end. is local subnet. SNMP polling from seems to work, but I cannot get data from -> is my config, I am most likely dong something wrong.

thanks for your time.

: Saved
ASA Version 8.4(3)
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
 description LAN
 nameif inside
 security-level 100
 ip address
interface Vlan2
 description WAN
 nameif outside
 security-level 0
 ip address
boot system disk0:/asa843-k8.bin
ftp mode passive
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns server-group DefaultDNS
object network obj-
object network obj-
object network obj-
object network obj_any
access-list crypto extended permit ip
access-list crypto extended permit ip
access-list NAT0 extended permit ip
access-list NAT0 extended permit ip
access-list from_outside extended permit icmp any any echo
access-list 101 extended permit ip
access-list 101 extended permit udp host host eq syslog
access-list 101 extended permit udp host host eq 5999
pager lines 24
logging enable
logging buffer-size 16096
logging buffered warnings
logging history notifications
logging asdm warnings
logging host outside
logging host outside 17/5999
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
nat (inside,outside) source static obj- obj- destination static obj- obj- no-proxy-arp route-lookup
nat (inside,any) source static obj- obj- destination static obj- obj- no-proxy-arp
nat (inside,any) source static obj- obj- destination static obj- obj- no-proxy-arp
object network obj_any
 nat (inside,outside) dynamic interface
route outside 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authorization command LOCAL
http server enable
http inside
http outside
snmp-server host inside poll community ***** version 2c
no snmp-server location
no snmp-server contact
snmp-server community *****
crypto ipsec ikev1 transform-set DES-MD5 esp-des esp-md5-hmac
crypto map AVA_tunnel 10 match address crypto
crypto map AVA_tunnel 10 set peer
crypto map AVA_tunnel 10 set ikev1 transform-set DES-MD5
crypto map AVA_tunnel interface outside
crypto isakmp identity address
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh inside
ssh outside
ssh timeout 5
ssh version 2
console timeout 0
management-access inside

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tunnel-group type ipsec-l2l
tunnel-group ipsec-attributes
 ikev1 pre-shared-key *****
policy-map global_policy
 class class-default
  inspect icmp
share|improve this question
Same issue here, this seems to be an issue on 8.4 but not 8.2 – user266502 Jan 22 '15 at 20:53

I have found that a common mistake is to not include a "logging trap" configuration command.

This is what we have on our customer ASAs to log to a syslog server, regardless of whether or not logging is performed over VPN:

logging enable
logging buffer-size 102400
logging buffered notifications
logging trap notifications
logging asdm notifications
logging host inside <IP of syslog server>
management-access inside
share|improve this answer

Your device is trying to send the syslog traffic out the outside interface, which won't get caught by the VPN tunnel's policy.

Switch to logging host inside instead.

share|improve this answer
I tried inside but still nothing. – Ankh2054 Jul 3 '13 at 14:41

As above you need to specify the source interface for logging

logging source-interface (interface e.g vlan 1)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.