topic Is syslog actually leaving my firewall? in Network Security

Is syslog actually leaving my firewall?

abatson — Tue, 12 Mar 2019 02:36:15 GMT

I'm freshly in charge of a Cisco ASA5510 firewall, and need to get its syslog sent to someplace where I can see it. Here's the pertinent part of the config:

logging enable

logging timestamp

logging monitor debugging

logging history notifications

logging asdm informational

logging facility 16

logging device-id hostname

logging host outside 10.10.10.10

logging host outside 20.20.20.20

I don't have access to the 10.10.10.10 host, so I don't know if it's receiving anything. My syslog server is the 20.20.20.20 host. TCPdump on this server shows no traffic at all coming from this ASA firewall. My next step, is to determine if the firewall is actually originating any syslog traffic at all. I don't have any ability to mirror any switch ports on the Outside Interface, so I need to use some method internal to the ASA itself to troubleshoot. Who's done this before, and/or what docs can you point me at, that could help?? ICMP shows up on tcpDump, so this means I can route to the syslog server OK, but I don't see any UDP/514 traffic at all. These IPs are valid & reachable by the firewall, but have obviously been mangled to protect privacy....

Is there something special I have to do (or is it an illegal configuration) to send syslog out an interface where the Security-Level is 0?

Thanks!

Re: Is syslog actually leaving my firewall?

Jouni Forss — Tue, 10 Sep 2013 19:27:51 GMT

Hi,

You dont seem to have the following configuration enabled

logging trap

Like for example

logging trap informational

logging trap notifications

It should set the level of log messages sent to the Syslog server. Without it I dont think any logs are sent to either of the defined servers.

- Jouni

Is syslog actually leaving my firewall?

Julio Carvajal — Tue, 10 Sep 2013 19:28:22 GMT

Hello,

You are missing the trap command

logging trap 7

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.com

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

Is syslog actually leaving my firewall?

abatson — Tue, 10 Sep 2013 19:32:48 GMT

Interesting -- I saw those commands in the docs I read, but I ignored them, because I thought they would cause the logging to be sent out of the firewall as SNMP traps (which I didn't want) I'll try these commands suggested & post my experience...

Is syslog actually leaving my firewall?

Jouni Forss — Tue, 10 Sep 2013 19:35:08 GMT

Hi,

Here is the section of ASA Command Reference describing the use of the above command

http://www.cisco.com/en/US/docs/security/asa/command-reference/l2.html#wp1797179

- Jouni

Is syslog actually leaving my firewall?

abatson — Tue, 10 Sep 2013 19:50:12 GMT

Excellent -- TCPdump showed UDP/514 streaming in once I entered:

logging trap informational

I also verified that my syslog server is writing it to disk, so everything is happy & healthy now. Thanks!