topic Re: FMC Audit Log/Syslog over TLS Port configuration in Network Security

FMC Audit Log/Syslog over TLS Port configuration

Ralf Wieseke — Fri, 20 Dec 2024 13:33:36 GMT

Hi Community,

I have configured a syslog server for Audit Logs on my FMC with TLS enabled. The FMC is sending messages on TCP 6514 but the syslog server is only accepting TCP 9140.

Is it possible to change the Port on FMC?

Syslog for the FTDs is working fine over TCP 9140

Regards,

Ralf

Re: FMC Audit Log/Syslog over TLS Port configuration

MHM Cisco World — Thu, 26 Dec 2024 16:50:07 GMT

MHM

Re: FMC Audit Log/Syslog over TLS Port configuration

Marvin Rhoads — Thu, 26 Dec 2024 16:18:20 GMT

Unfortunately, for an FMC sending syslog over TLS, the destination port (6514/tcp) is not configurable.

See table 3 here:

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/740/management-center-admin-74/reference-ports.html

Re: FMC Audit Log/Syslog over TLS Port configuration

ccieexpert — Thu, 26 Dec 2024 22:58:12 GMT

you might be able to use a hack to do a destination NAT to NAT the port.. but it is a hack.. i would just change the syslog server to accept it on a different port.