topic Re: Basic syslog on FMC and sensor in Network Security

Basic syslog on FMC and sensor

ebng — Fri, 21 Feb 2020 16:19:31 GMT

I'm trying to setup my FMC 1000 and FP 7030 sensor to send syslogs to an external server. All I really want for now is anything that gets populated under System->Monitoring->Syslog. I don't really care about intrusion alerts or things like that for now. I tried following the steps under "Sending Health Alerts" from the link below, but that didn't seem to get me anything (and I believe may be just for the sensor anyway):

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118464-configure-firesight-00.html#anc5

Any help would be appreciated.

Re: Basic syslog on FMC and sensor

babiojd01 — Fri, 05 Oct 2018 14:47:17 GMT

What syslog data are you looking for? Why don't we start with what data you do want sent to syslog. Security Intelligence, SNORT alerts, Fireamp, or Audit data from FMC?

Security Intel is syslog sent from the FTD/FP device itself. Snort Alerts can come through syslog via impact alerts from FMC as well as Network Fireamp.

Re: Basic syslog on FMC and sensor

Marius Gunnerud — Sat, 06 Oct 2018 09:51:11 GMT

To set up syslog for the FTD appliances go to Devices > Platform Settings > Syslog.

I have attached the configuration I use in my home lab FTD. Keep in mind that the FTD sends a lot more messages than an ASA does, so you may need to rate limit the messages. At a client had to rate limit to 4000 messages per second to get it to work properly. This is dependent on which syslog server you are using so check the specifications of your syslog server.

Re: Basic syslog on FMC and sensor

ebng — Mon, 08 Oct 2018 14:58:39 GMT

What I'd like to see is successful and failed logins, logouts, temperature warnings, crash info, things like that, for both my Firepower 7030 sensor and FMC 1000.

Re: Basic syslog on FMC and sensor

ebng — Mon, 08 Oct 2018 15:15:16 GMT

Hmmm...I'm seeing something different from my FMC. See attached. The first screenshot is from Devices->Platform Settings. The second is after I click the pencil icon next to my policy. I guess this is because I'm using a "legacy" sensor?

Re: Basic syslog on FMC and sensor

Marius Gunnerud — Mon, 15 Oct 2018 17:41:15 GMT

Which version are you running?