topic Re: FMC Logging Best Practises in Network Security

FMC Logging Best Practises

de1denta — Fri, 21 Feb 2020 15:39:31 GMT

Hi All,

I just wanted to check what the best practises are with logging against access control policy rules, specifically logging at the beginning of a connection vs logging at the end of a connection? I know that its not recommend to log both beginning and the end to reduce the number of connection events.

I also understand that blocked rules should log at the beginning of a connection as there is no end connection, however, with trust and allowed rules that we use (and that we need to log for compliance reasons) is there a preference to use one over the other?

Many thanks

Re: FMC Logging Best Practises

mikael.lahtela — Tue, 24 Apr 2018 17:50:50 GMT

Hi,

Logging at the end of connection will give more information about the connection.
Don't know if there is a best practices except the one you wrote, not to log both.
As the FMC event logging rotates fast I would try to log as little as possible in the connection event just for troubleshooting purposes and use external logging for archive.
Read somewhere that maybe disable logging for DNS request if that is not important for you, as DNS pretty log heavy.

Here is some more information about logging:
https://www.cisco.com/c/en/us/td/docs/security/firepower/601/configuration/guide/fpmc-config-guide-v601/Connection_Logging.pdf

https://supportforums.cisco.com/t5/firesight-system-3d-system/logging-recommendations/td-p/2895705

br, Micke

Re: FMC Logging Best Practises

de1denta — Tue, 24 Apr 2018 19:20:39 GMT

Thanks Mikael, very helpful!