topic Re: ASA Syslog UDP port 10514 in Network Security

ASA Syslog UDP port 10514

quadrabe — Fri, 17 Feb 2023 13:34:39 GMT

We're running version 9.18(3).
Whenever we try to add a syslog server with UDP/10514 we can see that the syslog server never receives a packet.
If we change the port to 514 we can see packets arriving on the syslog server. However, we would like to use 10514.

Not working config
logging host uplink x.x.x.x 17/10514

Working config
logging host uplink x.x.x.x

Re: ASA Syslog UDP port 10514

MHM Cisco World — Fri, 17 Feb 2023 13:41:38 GMT

logging host uplink x.x.x.x UDP/10514

Re: ASA Syslog UDP port 10514

balaji.bandi — Fri, 17 Feb 2023 21:17:36 GMT

as long as syslog listening 10514 and you have correct systax that should work - I am using non standard port works as expected :

logging host interface_name ip_address [tcp[/port] | udp[/port]] [format emblem]

old but good reference from my notes:

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html

Re: ASA Syslog UDP port 10514

quadrabe — Mon, 20 Feb 2023 09:15:20 GMT

Hi

When trying this it automatically reverts to logging host uplink x.x.x.x 17/10514.
Which should be fine, UDP is protocol number 17.

Re: ASA Syslog UDP port 10514

quadrabe — Mon, 20 Feb 2023 09:17:08 GMT

Hi

I was following that guide as well.
The server is listening on port 10514 as other devices are able to put their syslog files onto it.

Re: ASA Syslog UDP port 10514

balaji.bandi — Mon, 20 Feb 2023 09:42:47 GMT

so the question here other devices able send logs to that port towards syslog, only ASA not able to send Logs using custom ports ?

I have used that document and tested with ASA/ FTD with custom ports works for me.

by the what syslog server, do you have any Firewall on the syslogs server ? is there any other Firewall between ASA and syslog ?

enable debug both the side.

Re: ASA Syslog UDP port 10514

MHM Cisco World — Mon, 20 Feb 2023 11:05:48 GMT

understood, so you show us show running.
anyway
are you config any control ACL in ASA interface uplink ??