topic Re: Syslog warning on FMC when deploying changes in Network Security

Syslog warning on FMC when deploying changes

ABaker94985 — Wed, 01 Dec 2021 16:52:28 GMT

Whenever a change is deployed, the following warning is displayed:

Access Policy: Logging: FTD-XXXXX
Warning: Access Control Policy Logging configuration is invalid. Access Control rules have syslog configured to use Access Control policy's logging configuration. Configure a valid syslog destination to avoid syslogs not being sent.

Syslog is configured under Devices | Platform Settings | Syslog | Syslog Servers, so I presume there is another setting elsewhere?

The following settings are also configured.

Under "Logging Setup" tab the following are checked: Enable Logging, Enable Logging on the failover standby unit, and Enable Logging to FMC (under VPN Logging Settings)

I appreciate any info associated with this warning. I get 0 hits when doing a Google search for this.

Re: Syslog warning on FMC when deploying changes

Rob Ingram — Wed, 01 Dec 2021 17:11:43 GMT

@ABaker94985 do you have syslogging enabled on one of the specific Access Control rules?

Re: Syslog warning on FMC when deploying changes

ABaker94985 — Wed, 01 Dec 2021 17:48:02 GMT

Yes, there are multiple rules with syslog.

Re: Syslog warning on FMC when deploying changes

ABaker94985 — Wed, 01 Dec 2021 22:08:43 GMT

I believe I found the problem. Under Policies | Access Control, there was a Logging tab with nothing set. Once I entered the Syslog Alert and Severity, and also checked the box for "File and Malware Settings," the warning no longer pops up. I'll consider this closed. Thanks for your input.

Re: Syslog warning on FMC when deploying changes

abalasekaran — Thu, 14 Sep 2023 09:49:47 GMT

Uncheck send to syslog on the default policy logging