Configuring a secure syslog server and client

Use the following procedures to configure a secure syslog server and client.

If the connection is broken, the client side will keep trying to re-establish the connection.

For best security, administrators must use SSH/HTTPS for remote administration sessions.

To configure a secure syslog server:

Enter the CLI configuration mode:

hostname > enable
hostname # configure terminal

Set the receiving protocol of the rsyslog server:

hostname (config) # logging receive protocol tls port <port_number>

Configure the receive syslog cipher list for SSL/TLS:
```
hostname (config) # logging receive ssl cipher-list <cipher-list-name>
```
where <cipher-list-name> can be fips (compliant with FIPS 140-3), fips-high-security (high security compliant with FIPS 140-3), cc-ndpp (compliant with CC-NDPP), cc-ndpp-high-security (high security compliant with CC-NDPP), fips-and-cc-ndpp (compliant with both FIPS 140-3 and CC-NDPP), or fips-and-cc-ndpp-high-security (high security compliant with both FIPS 140-3 and CC-NDPP).

Require TLSv1 or higher for remote syslog:

hostname (config) # logging receive ssl min-version tls1

To configure a secure syslog client:

Enter the CLI configuration mode:

hostname > enable
hostname # configure terminal

Specify the port and the protocol to log on to the remote host:
```
hostname (config) # logging <hostname> protocol tls port <port_number>
```
where <hostname> is the hostname or IP address of a syslog server where you want to send log messages.
Enable the remote syslog SSL/TLS certificate verification:
```
hostname (config) # logging remote ssl cert-verify 
```
Configure the remote syslog cipher list for SSL/TLS:
```
hostname (config) # logging remote ssl cipher-list <cipher-list-name>
```
where <cipher-list-name> can be fips (compliant with FIPS 140-3), fips-high-security (high security compliant with FIPS 140-3), cc-ndpp (compliant with CC-NDPP), cc-ndpp-high-security (high security compliant with CC-NDPP), fips-and-cc-ndpp (compliant with both FIPS 140-3 and CC-NDPP), or fips-and-cc-ndpp-high-security (high security compliant with both FIPS 140-3 and CC-NDPP).
Save your changes:
```
hostname (config) # write memory
```