Description

This article provides steps to configure and verify syslog forwarding on a Session Smart Router (SSR) using the Juniper Mist portal, including enabling syslog, ensuring network reachability, configuring traffic steering, and validating logs on the syslog server.

Solution

Please Note:  A minimum firmware version of 128T-7.0.0-r1 is required for the Syslog feature on SSR device , You need to upgrade the device on SSR 7.0.1 release as you are running older version of SSR release.
Follow the steps below to configure and verify syslog forwarding from an SSR device using Mist.

 

1. Configure WAN Edge Device

 

  1. Navigate to the WAN Edge device configuration/template in Mist.
  2. Locate the IP Configuration (In-Band) section.
  3. Enter a unique IP address for each node:
    • Single node: Configure one IP address.
    • HA cluster: Configure two unique IP addresses (one for each node).

2. Enable Syslog Forwarding

  1. Enable the Syslog option in the configuration.
  2. Ensure that the configured IP address is:
    • Routable from the LAN interface
    • Reachable by management services such as the syslog server

Example scenario:

  • A LAN interface is created where the syslog server is connected.

3. Configure Network Reachability

a) If the syslog server is directly connected to the LAN network, ensure the LAN interface is configured accordingly.

 

b)If the syslog server is not directly connected, configure the network under:

Organization → Networks → Defined Network (not directly connected)

 

4. Verify Traffic Steering Configuration

  1. Go to Application Policies.
  2. Under Device Out, verify that the syslog policy references the correct traffic steering profile.
  3. Ensure the profile routes the syslog traffic through the LAN interface.

5. Deploy Configuration

  • Save the configuration.
  • Deploy the changes to the SSR device.

6. Verify Syslog Traffic

On the syslog server, verify that logs are being received using tcpdump.

Example command:

tcpdump -v -n -s0 -i any port 514 and host <SSR-IP>

 

Example output:

root@ubuntu:/home/lab# tcpdump -v -n -s0 -i any port 514 and host x.x.x.x

 

This confirms whether syslog packets from the SSR device are reaching the syslog server.

Modification History

2026-03-09 : Article Created