topic appl logging to multiple rules in Network Security

appl logging to multiple rules

stuart.rock — Tue, 12 Mar 2019 14:14:32 GMT

Hi,

looking for some help.

i am working on a firewall with 750 rules. most of these rules are not set to log.

is there any way to apply logging (at end) to a select bunch of rules in one hit. or am i looking at clicking 750 rules one at a time to switch logging on.

also when logging is enabled (to event viewer) is this held in FMC? i want to send all rule hits to a syslog server - do i need to enable this per rule - as above? or will FMC do that for me?

thanks in advance

Re: appl logging to multiple rules

Abheesh Kumar — Tue, 22 Jan 2019 17:56:10 GMT

Hi,
There is no such option to edit multiple rules in a single shot. You need to edit each rule and enable logging.
You can configure syslog server from the Device > Platform Setting > Threat Defense Policy > Syslog
https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html

Thanks,
Abheesh
PS: Please don't forget to rate and select as validated answer if this answered your question.

Re: appl logging to multiple rules

iabualna — Tue, 29 Aug 2023 07:56:37 GMT

There is no such option to edit multiple rules in a single shot, as mentioned by Abheesh. We have the ENH below for the same:

"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe32569

"ENH: Add option to enable Syslog on all Access Control Policies rules"