Network Hierarchy Security Logging

Configure global security logging settings for the SD-WAN network hierarchy. This includes high speed logging (HSL) and UTD external syslog servers.

Diagram

Classes

collectors (sdwan.network_hierarchy)

Name	Type	Constraint	Mandatory	Default Value
security_logging	Class	[security_logging]	No

security_logging (sdwan.network_hierarchy.collectors)

Name	Type	Constraint	Mandatory	Default Value
external_syslog_server	Class	[external_syslog_server]	No
high_speed_logging_servers	List	[high_speed_logging_servers]	No

external_syslog_server (sdwan.network_hierarchy.collectors.security_logging)

Name	Type	Constraint	Mandatory	Default Value
lan_vpn_name	String		Yes
server_ip	IP		Yes

high_speed_logging_servers (sdwan.network_hierarchy.collectors.security_logging)

Name	Type	Constraint	Mandatory	Default Value
lan_vpn_name	String		Yes
server_ip	Any	IP or IP	Yes
port	Integer	min: 1, max: 65535	No	2055

Examples

Example-1: High speed logging only

sdwan:
  network_hierarchy:
    collectors:
      security_logging:
        high_speed_logging_servers:
          - lan_vpn_name: service_lan_vpn1
            server_ip: 10.1.2.1
            port: 2055

This example configures a single high speed logging server for firewall event export. The VRF references a service LAN VPN by name.

Example-2: Combined HSL and external syslog

sdwan:
  network_hierarchy:
    collectors:
      security_logging:
        high_speed_logging_servers:
          - lan_vpn_name: service_lan_vpn1
            server_ip: 10.1.2.1
            port: 2055
          - lan_vpn_name: service_lan_vpn2
            server_ip: 10.1.3.1
            port: 2056
        external_syslog_server:
          lan_vpn_name: service_lan_vpn1
          server_ip: 10.1.1.2

This example configures two HSL servers across different VRFs and one external syslog server for IPS/URL filtering event logging.

Notes:

• Each lan_vpn_name must reference an existing name under sdwan.feature_profiles.service_profiles.lan_vpns.
• Upto 4 High speed logging servers can be configured