topic I think its actually the in Network Security

Firepower rule (connection) logging to Syslog question

corpengineer818 — Sun, 10 Mar 2019 13:47:58 GMT

Firepower rule (connection) logging to Syslog: When configuring a rule and 'Send Connection Events to', and Syslog is selected, what is source IP of the host sending the Syslog message? Is it the IP of the Firepower Management Center, or the source IP from the connection itself being logged?

Thank you.

Your FirePOWER Management

Marvin Rhoads — Sun, 19 Mar 2017 20:32:49 GMT

Your FirePOWER Management Center interface sensor's address will be the source IP in the syslog message header. The body of the message should have the addresses specific to the connection record.

I think its actually the

Oliver Kaiser — Sun, 19 Mar 2017 20:32:50 GMT

I think its actually the sensor that will forward the connection event via syslog. I checked this in the lab with 6.2.0 and saw that syslog was sent directly and not from the FMC.

Thanks for the correction

Marvin Rhoads — Mon, 20 Mar 2017 02:04:51 GMT

Thanks for the correction Oliver. An ounce of data is more valuable than a pound of conjecture.

I updated my earlier reply accordingly.

That makes a lot more sense

corpengineer818 — Mon, 20 Mar 2017 18:22:30 GMT

That makes a lot more sense (that the source is the device/sensor). Wasn't seeing anything logged from the FMC. I'll adjust my firewall rules to allow the sensor, and this should work now.

Thank you.