topic Re: Syslog in FMC in Network Security

Syslog in FMC

shaikh.zaid22 — Thu, 27 Apr 2023 13:18:58 GMT

hi,

i am having ftd's managed via fmc running ver7.0.1 and the FMC is configured too forward vpn logs to syslog server which is a forescout NAC appliance.

Since we are not getting any logs in the destination, i want to know how to verify the vpn logs are being sent by FMC managment interface ip address or the active FTD device??

Re: Syslog in FMC

Rob Ingram — Thu, 27 Apr 2023 13:29:10 GMT

@shaikh.zaid22 the syslogs are sent from the FTD to the configured syslog server.

If you are not receiving the logs run a packet capture to confirm the logs are being transmitted and double check the configuration.

Re: Syslog in FMC

MHM Cisco World — Thu, 27 Apr 2023 13:39:10 GMT

Can I know ftd platform you have ?

Re: Syslog in FMC

Marvin Rhoads — Thu, 27 Apr 2023 16:47:38 GMT

Adding to what @Rob Ingram said, the syslog message should originate from the management address of the active FTD (assuming you have it setup properly in the platform settings).

Re: Syslog in FMC

shaikh.zaid22 — Thu, 27 Apr 2023 19:28:22 GMT

Rob can u share the packet capture cpmmand.

Re: Syslog in FMC

shaikh.zaid22 — Thu, 27 Apr 2023 19:28:46 GMT

FTDs model is 2110

Re: Syslog in FMC

shaikh.zaid22 — Thu, 27 Apr 2023 19:29:41 GMT

Thanks Marvin

I have configured specific ravpn logs only to be forwarded to syslog server.

Re: Syslog in FMC

shaikh.zaid22 — Mon, 01 May 2023 13:03:30 GMT

Hi rob,

Can u pls provide the command or the doc pls

Re: Syslog in FMC

MHM Cisco World — Mon, 01 May 2023 13:50:35 GMT

Access to mgnt interface of ftd

Then

System support diagnostics cli

Then

Ping to syslog server <<- are ping success ?

Re: Syslog in FMC

shaikh.zaid22 — Mon, 01 May 2023 17:35:04 GMT

yes its pingable from ftd.

Re: Syslog in FMC

MHM Cisco World — Mon, 01 May 2023 18:00:04 GMT

firepower# sh run logging <<- can I see this

few more tips to check
are there any other FW between the Syslog and FTD ? are log UDP port is Open ? are the Syslog listen to UDP or TCP port ?
what is accept log format by Syslog?

Re: Syslog in FMC

shaikh.zaid22 — Mon, 01 May 2023 18:09:09 GMT

Sure will provide the log.

No FW in between. UDP port 514 is open and working for other traffic. Whenever ravpn client connects or disconnects this info is not coming-in to the syslog.

Re: Syslog in FMC

MHM Cisco World — Mon, 01 May 2023 18:15:39 GMT

if traffic log is send and only RAVPN is not what is level of logging you use ?

Any VPN syslogs that are displayed have a default severity level ‘ERROR’ or higher (unless changed). VPN logging is managed through FTD platform settings.