FMC default logging profile

rosarra — Tue, 05 Oct 2021 09:41:36 GMT

Hello,

in my network infrastructure I have installed two FTD 4112 (6.7) controlled by two FMC 2600 (7.0)
After setting the log on each rule (one by one) on the FMC I can see the events on the controller GUI. Now I would like to send the logs also on a syslog server that I have configured in the FMC settings. Unfortunately I don't receive any allow or drop event of the rules and I suspect I have to configure one by one (again) all the rules adding the log option on the syslog server. Is it possible to configure a super rule or a default profile that sets the same behavior for all the rules?

Thank you,

Re: FMC default logging profile

Marvin Rhoads — Tue, 05 Oct 2021 12:27:52 GMT

You can multi-select access control policy rules to change common elements like logging.

Select your first rule, hold the Shift key and then select the last rule (or use Control key for non-contiguous rules). Right click and select edit.

You should see something like this:

topic FMC default logging profile in Network Security

FMC default logging profile

Re: FMC default logging profile