topic Re: Cisco Firepower Logging in Network Security

Cisco Firepower Logging

mikiNet — Mon, 07 Jun 2021 12:41:51 GMT

Hello Guys,

I have a question related to logging on Firepower. We have two option to configure it, first via Platform Setting, second via tab in Access Control Policy (this tab is near Security Intelligence, HTTP Response etc.)

Question is: What is difference between logging on Platform Setting vs logging on ACP ? Pros and cons? When using ?

I can't find any good explanation about it.

Re: Cisco Firepower Logging

balaji.bandi — Mon, 07 Jun 2021 13:01:16 GMT

As per my understanding. here is what i can describe simple :

Platform Setting - Looging is more related to device logging like errors and events, you can select what kind of logs to be generated and logs to syslog server

Access Control Policy - Logging - more related to Policy logs ( accept or denined logs ..etc kind). ( you can beging of the connection or ending of the connection, or both)

Re: Cisco Firepower Logging

mikiNet — Mon, 07 Jun 2021 13:09:59 GMT

No,

I mean this tab:

Re: Cisco Firepower Logging

balaji.bandi — Mon, 07 Jun 2021 13:55:11 GMT

Hope you are using FDM here ? But yes that is for ACP Logging

Re: Cisco Firepower Logging

mikiNet — Mon, 07 Jun 2021 15:26:35 GMT

No, I using FMC. This screenshot is only example what I mean.

So if I enable Logging tab in Access Control Policy I also should enable Logging in Access Control Rule, yes ?

Re: Cisco Firepower Logging

Marvin Rhoads — Mon, 07 Jun 2021 17:56:25 GMT

The logging tab in your ACP screenshot primarily refers to syslog setting for those things that have associated syslog actions.

All ACP entries, including the default action, need to have their settings individually set to log or not - it can be to the FMC Connection events, to syslog server or as an SNMP trap. We also choose to log at beginning or end of connection there.

Re: Cisco Firepower Logging

mikiNet — Mon, 07 Jun 2021 18:36:20 GMT

Ok, so to log ACP entries I need to set syslog in Logging tab globaly in ACP and also set Logging to syslog server on individual rule (ACE) ? This two configuration need to be done to send syslog messages to syslog server ?

Re: Cisco Firepower Logging

Marvin Rhoads — Mon, 07 Jun 2021 19:06:01 GMT

Yes - but only if you want to use a external syslog server. The majority of my customers log primarily (and only) to the FMC.

Re: Cisco Firepower Logging

Peter Koltl — Thu, 09 Jan 2025 18:45:14 GMT

Best Practices for Configuring Security Event Syslog Messaging

Do not use Policies > Actions > Alerts if it is an FTD:

Beginning vs End-of-Connection Logging