# Cisco core switch integration

**URL:** <https://discuss.elastic.co/t/cisco-core-switch-integration/259711>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 28, 2020, 7:10am UTC](https://discuss.elastic.co/t/cisco-core-switch-integration/259711 "2020-12-28T07:10:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbathla](https://avatars.discourse-cdn.com/v4/letter/s/c4cdca/32.png) [@sbathla](https://discuss.elastic.co/u/sbathla)\
**Post date:** [December 28, 2020, 7:10am UTC](https://discuss.elastic.co/t/cisco-core-switch-integration/259711/1 "2020-12-28T07:10:09Z")

</div>

Hi All,

I am trying to integrate elasticsearch with cisco core switch.I have done the required configuration in filebeat file and cisco module file.

But while sending logs from core switch on port 9506, getting error that server is temporarily unreachable

Requesting support to help me out to fix this issue

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/5/85ac7d530083d4f60c53ca9bf0227aa743a2418a.png)

filebeat configuration

# ============================== Filebeat inputs ===============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so

# you can use different inputs for various configurations.

# Below are the input specific configurations.

- type: log

---------------------------- Elasticsearch Output ----------------------------  
output.elasticsearch:

# Array of hosts to connect to.

hosts: ["[http://elasticsearchip:9200](http://elasticsearchip:9200)"]

cisco module configuration

nexus:  
enabled: true

```
# Set which input to use between udp (default), tcp or file.
var.input: udp
var.syslog_host: filebeat host ip
var.syslog_port: 9506
```

---

<div class="post-metadata">

**Author:** ![fadjar340](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fadjar340/32/43610_2.png) [@fadjar340](https://discuss.elastic.co/u/fadjar340)\
**Post date:** [December 28, 2020, 8:33am UTC](https://discuss.elastic.co/t/cisco-core-switch-integration/259711/2 "2020-12-28T08:33:51Z")

</div>

What is your filebeat status?  
Can you try to check the UDP open port using nc:

```auto
nc -vvvvu <filebeatIP> 9506

```

---

<div class="post-metadata">

**Author:** ![sbathla](https://avatars.discourse-cdn.com/v4/letter/s/c4cdca/32.png) [@sbathla](https://discuss.elastic.co/u/sbathla)\
**Post date:** [December 28, 2020, 9:05am UTC](https://discuss.elastic.co/t/cisco-core-switch-integration/259711/3 "2020-12-28T09:05:25Z")

</div>

> [@fadjar340](#):
>
> `nc -vvvvu <filebeatIP> 9506`

Hi,

please find the below response

nc -vvvvu 9506  
Ncat: Version 7.50 ( [Ncat - Netcat for the 21st Century](https://nmap.org/ncat) )  
NCAT DEBUG: Using system default trusted CA certificates and those in /usr/share /ncat/ca-bundle.crt.  
NCAT DEBUG: Unable to load trusted CA certificates from /usr/share/ncat/ca-bundl e.crt: error:02001002:system library:fopen:No such file or directory  
libnsock nsi\_new2(): nsi\_new (IOD #1)  
libnsock msevent\_new(): msevent\_new (IOD #1) (EID #8)  
libnsock nsock\_connect\_udp(): UDP connection requested to :9506 (IOD # 1) EID 8  
libnsock nsp\_add\_event(): NSE #8: Adding event  
libnsock nsock\_loop(): nsock\_loop() started (no timeout). 1 events pending  
libnsock nsock\_trace\_handler\_callback(): Callback: CONNECT SUCCESS for EID 8 [5:9506]  
Ncat: Connected to :9506.  
libnsock nsi\_new2(): nsi\_new (IOD #2)  
libnsock msevent\_new(): msevent\_new (IOD #1) (EID #18)  
libnsock nsock\_read(): Read request from IOD #1 [:9506] (timeout: -1ms ) EID 18  
libnsock nsp\_add\_event(): NSE #18: Adding event  
libnsock msevent\_new(): msevent\_new (IOD #2) (EID #26)  
libnsock nsock\_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecifi ed] EID 26  
libnsock nsp\_add\_event(): NSE #26: Adding event  
libnsock msevent\_delete(): msevent\_delete (IOD #1) (EID #8)

nc -vu 10. 9506  
Ncat: Version 7.50 ( [Ncat - Netcat for the 21st Century](https://nmap.org/ncat) )  
Ncat: Connected to :9506.

nc -vuz 9506  
Ncat: Version 7.50 ( [Ncat - Netcat for the 21st Century](https://nmap.org/ncat) )  
Ncat: Connected to :9506.  
Ncat: UDP packet sent successfully  
Ncat: 1 bytes sent, 0 bytes received in 2.02 seconds.

---

<div class="post-metadata">

**Author:** ![fadjar340](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fadjar340/32/43610_2.png) [@fadjar340](https://discuss.elastic.co/u/fadjar340)\
**Post date:** [December 28, 2020, 9:18am UTC](https://discuss.elastic.co/t/cisco-core-switch-integration/259711/4 "2020-12-28T09:18:09Z")

</div>

That's good..  
Perhaps from the cisco machine to the filebeat, there is some blocking

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 25, 2021, 11:18am UTC](https://discuss.elastic.co/t/cisco-core-switch-integration/259711/5 "2021-01-25T11:18:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.