topic Re: Cisco FTD / FDM Event Viewer or Realtime Monitoring in Network Security

Cisco FTD / FDM Event Viewer or Realtime Monitoring

wcutajar — Mon, 12 Jul 2021 12:41:37 GMT

Hi I'm testing out a new FTD 1000 series and having a real hard time since i'm very used to ASA and ASDM.

I'm having an issue with Monitoring > Events which is always empty. I need to know what events are happening in realtime similar to "Monitoring > Logging > View on ASA but i'm unable to do so.

Re: Cisco FTD / FDM Event Viewer or Realtime Monitoring

balaji.bandi — Mon, 12 Jul 2021 12:55:09 GMT

You need to enable Logging for the ACP to get the Logs (have you ?)

Make sure you configure - platform setting for Logs

FMC - Go to Policies-->Access-Policies

Select ACP - use Logging ( depends on requirement)

Re: Cisco FTD / FDM Event Viewer or Realtime Monitoring

wcutajar — Mon, 12 Jul 2021 12:56:53 GMT

Unfortunately we're not using FMC, we're using FDM (Firepower Device Manager) to configure.

Re: Cisco FTD / FDM Event Viewer or Realtime Monitoring

balaji.bandi — Mon, 12 Jul 2021 14:11:43 GMT

should be same i guess, never used FDM ( as per i know there is Limited features compare to FMC)

Look at the config guide : you may find some information

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660.html

Re: Cisco FTD / FDM Event Viewer or Realtime Monitoring

Rob Ingram — Mon, 12 Jul 2021 14:23:07 GMT

@wcutajar

On FDM navigate to Policies > Access Control. Then modify each Access Rule, click the "Logging" tab and then enable Logging, best practice is to enable at the End of the Connection. Save and deploy policy.

Example:-

Re: Cisco FTD / FDM Event Viewer or Realtime Monitoring

wcutajar — Mon, 12 Jul 2021 14:30:07 GMT

Awesome This worked thank you!