Security Compliance

Configure Cisco IOS devices to identify as node names instead of IP addresses in SEM

This article describes how to configure a Cisco IOS-based device to add its node name to its events. This will cause the name to be reflected under the Node Name field in the Nodes page and DetectionIP field in all events from that device.

First published date

11/8/2018 9:40 PM

Last published date

11/8/2018 9:40 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).
You may come across a scenario where some cisco IOS based devices not able to resolve IP address of the Cisco device to Hostname and SEM console shows the Detection IP rather than Hostname.

Also, under the manage nodes page the Cisco devices are shown as IP addresses rather than Hostnames.

Product section

Security Event Manager

Cause

  • DNS Resolution is not configured correctly on some devices in your Environment
  • Known Cisco IOS bug in certain Cisco IOS versions

Resolution

To very the DNS logging is correctly set on the Cisco device, you can:
  1. Connect to your Cisco device using SSH.
  2. Run the following command in the prompt: (Please note this command may not always work depending on your Cisco IOS version) 
    logging origin-id hostname
  3. Commit the changes and close the session.
  4. Confirm the DNS SEM uses can resolve the IP and hostname