topic Re: FMC does not log HTTP/HTTPS Connection Events in Network Security

FMC does not log HTTP/HTTPS Connection Events

rezaalikhani — Mon, 21 Jul 2025 09:18:49 GMT

Hi everybody;

My lab consists one FMCv with version 7.4.2.3 and one FTDv in Routed mode with version 7.4.2.3. I have created an Access Control Rule with the following conditions:

I have also configured the logging operation as follows:

Now when a user with IP address 192.168.10.10 tries to open a web site published on a Windows Server behind FTDv, FMC does not log any Connection Events. Every other network access to the server is logged correctly and successfully.

Any ideas?

Thanks

Re: FMC does not log HTTP/HTTPS Connection Events

MHM Cisco World — Mon, 21 Jul 2025 09:31:55 GMT

Use packet tracer feature of fmc

Check if traffic hit the correct ACL or not

MHM

Re: FMC does not log HTTP/HTTPS Connection Events

rezaalikhani — Mon, 21 Jul 2025 09:52:37 GMT

Thanks. Using the Packet Tracer functionality, it matches the correct ACL.

Re: FMC does not log HTTP/HTTPS Connection Events

MHM Cisco World — Mon, 21 Jul 2025 09:58:43 GMT

Points to check

1- trust don't have log function, change action to allow (permit)

2- some traffic need to config with log at beginning

MHM

Re: FMC does not log HTTP/HTTPS Connection Events

Marvin Rhoads — Mon, 21 Jul 2025 12:31:26 GMT

Good points @MHM Cisco World .

@rezaalikhani also note that "log at end of connection" only triggers for a Permit rule where the connection closes gracefully with a TCP FIN

Re: FMC does not log HTTP/HTTPS Connection Events

rezaalikhani — Mon, 21 Jul 2025 13:25:42 GMT

@Marvin Rhoads @MHM Cisco World So, the Trust action does not trigger a log even if I have selected the "Log at end of connection" option in the Logging session?

Re: FMC does not log HTTP/HTTPS Connection Events

MHM Cisco World — Mon, 21 Jul 2025 13:27:00 GMT

Yes

MHM

Re: FMC does not log HTTP/HTTPS Connection Events

rezaalikhani — Mon, 21 Jul 2025 16:02:07 GMT

@MHM Cisco World The funny thing is that, if you use Packet Tracer, it generates an event, even if you select Trust action. Any ideas?

Thanks

Re: FMC does not log HTTP/HTTPS Connection Events

MHM Cisco World — Mon, 21 Jul 2025 16:10:02 GMT

How you config packet tracer?

Are you use correct interface as ingress interface

Are you use real Ip or map ip (if you use NAT)

MHM

Re: FMC does not log HTTP/HTTPS Connection Events

rezaalikhani — Tue, 22 Jul 2025 15:17:04 GMT

Re: FMC does not log HTTP/HTTPS Connection Events

MHM Cisco World — Tue, 22 Jul 2025 16:07:35 GMT

I see ingress interface is different between two packet tracer?

MHM

Re: FMC does not log HTTP/HTTPS Connection Events

MHM Cisco World — Sun, 27 Jul 2025 13:00:51 GMT

Any update

MHM

Re: FMC does not log HTTP/HTTPS Connection Events

rezaalikhani — Sat, 02 Aug 2025 05:57:04 GMT

Thanks for your follow up...

Please consider my configuration:

Now, the client opens an SSH session to the target device and then closes the session. As you can see below, FMC correctly triggers a Trust connection event:

Any ideas?

Thanks

Re: FMC does not log HTTP/HTTPS Connection Events

MHM Cisco World — Sat, 02 Aug 2025 17:23:18 GMT

Sorry can you elaborate I dont get your last comment

MHM