Allow a public IP address to forward Syslog to an on-Premises SIEM

[krishnahutait]

Hello.

I have a customer requirement, Where they have a Cisco ESA, and they would like to allow a public IP address in ESA to transfer the Syslog data to an on-premises SIEM solution.

Can anyone please clarify, Whether it is possible or not, If yes How?

Thanks in Advance.

Best Regards,

Krishna

[balaji.bandi]

its syslog message that should be ok using securly.

[krishnahutait]

My queries is. Is it possible? If yes How we can allow a specific IP

[balaji.bandi]

you have to do static Routing to the desitnation IP.

[Ken Stieers]

Pretty sure if you create a static route to the SEIM with a next hop of a router that's on the public interface side, it will go out that interface/IP.
But keep in mind all traffic to the SEIM box will be going out that route... not just Syslog.