Cisco ASR 1004 User Manual

Page 21 of 72
1. Logging of command execution must be enabled:
TOE-common-criteria(config)#archive
TOE-common-criteria(config)#no logging console
TOE-common-criteria(config-archive)#log config
TOE-common-criteria(config-archive-log-cfg)#logging enable
TOE-common-criteria(config-archive-log-cfg)#hidekeys
TOE-common-criteria(config-archive-log-cfg)# logging size <1000> ! Increases queue
size for messages to be sent to syslogd
TOE-common-criteria(config-archive-log-cfg)#notify syslog
TOE-common-criteria(config-archive-log-cfg)#exit
TOE-common-criteria(config-archive)#exit
2. Add year to the timestamp:
TOE-common-criteria(config)# service timestamps log datetime year
TOE-common-criteria(config)# service timestamps debug datetime year
3. Enable any required debugging. Debugging is needed for radius (if used), isakmp (if
using ikev1), ipsec, ikev2 (if using ikev2), and ntp to generate the events required in the
Security Target, however administrators should use discretion when enabling a large
number of debugs on an on-going basis:
TOE-common-criteria# debug radius authentication
TOE-common-criteria# debug crypto isakmp
TOE-common-criteria# debug crypto ipsec
TOE-common-criteria# debug crypto ikev2
TOE-common-criteria# debug ntp all
TOE-common-criteria# debug crypto pki server
4. Set the size and severity of the local logging buffer. The local logging buffer size can be
configured from a range of 4096 (default) to 2,148,483,647 bytes. It is noted to not make
the buffer size too large because the TOE could run out of memory for other tasks. It is
recommended to set it to at least 150000000:
TOE-common-criteria(config)# logging buffer 150000000
TOE-common-criteria(config)# logging buffer debug
5. To generate logging messages for failed and successful login attempts in the evaluated
configuration, issue the login on-failure and login on-success commands:
TOE-common-criteria(config)#login on-failure log
TOE-common-criteria(config)#login on-success log
6. To configure the logs to be sent to a syslog server:
TOE-common-criteria(config)# logging host <ip address of syslog server>
Ex. TOE-common-criteria(config)# logging host 192.168.202.169
7. To specify the severity level for logging to the syslog host, use the logging trap
command. Level 7 will send all logs required in the evaluation up to the debug level logs
(as enabled in step 3 above) to the syslog server:
TOE-common-criteria(config)# logging trap 7

Cisco ASR 1004 Specifications

General

Product Type	Router
Form Factor	Rack-mountable
Rack Height	2U
Forwarding Capacity	Up to 20 Gbps
Total Number of Ports	Varies by configuration
Number of Total Expansion Slots	4
Product Series	ASR 1000
Model	ASR 1004
Forwarding Performance	Up to 20 Gbps
Operating System	Cisco IOS XE
Power Supply	Dual
Route Processor	ASR 1000 Series Route Processor
Network Interface Modules	SFP, SFP+, Gigabit Ethernet, 10 Gigabit Ethernet
Interfaces/Ports	Varies by configuration
Expansion Slot Type	SPA
Throughput	20 Gbps
Redundancy	Power supply, Route Processor
Interfaces	Gigabit Ethernet, 10 Gigabit Ethernet, SFP, SFP+
Storage	Up to 64 GB Flash