topic Re: Firepower URL Logging to Syslog in Network Security

Firepower URL Logging to Syslog

darreng — Sun, 10 Mar 2019 13:35:32 GMT

Would appreciate if someone could give me a pointer.

I have a 5525X running Firepower (Protection, URL, Malware and Control licence). I have a basic Access Contol policy with a few URL's Categories defined and a seperate URL I defined for testing. I have a default policy underneath that calls a base Intrusion policy. The URL policy and Base Intrusion policy are set to Log to a syslog server.

I don't see URL's logged on the syslog although they do appear in the Management Centre. The IPS policies log to the syslog.

The Access Control policy does have the syslog defined and the box for 'log at the beginning of the connection' is checked. I went thought the config guide (v6.X) and picked out those items that referred to syslog. I'm not sure why the URL logging isn't working.

All I want to see is the URL's (IP and URL info) information on the syslog, currently syslog is set to facility: Local 1 and severity: info as requested by my Linux admin.

Note the device is in monitor mode only at present.

Regards

Darren

Try making a rule at the very

Dennis Perto — Thu, 17 Nov 2016 17:55:51 GMT

Try making a rule at the very top of your access control policy with the action of "Monitor".

Under the URL tab you add a single URL like "dummy.url".

Remember to log to both event viewer and syslog. 🙂

Re: Firepower URL Logging to Syslog

dncl — Tue, 26 Jun 2018 12:28:24 GMT

Was there ever a solution found for this?

We are experiencing the same problem... basically only blocked traffic is being sent to our Syslog server, and our Defense Center logs roll fairly quickly so troubleshooting is nearly impossible.