cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

669
Views
5
Helpful
2
Replies

logging issues in Cisco FTD

Hello 

i have got an issue in FTD logging.

i have configured logging in Cisco Firepower 4110 running FTD 6.2.2 and i have configured logging to log from all connections and sessions.

i have NAT on the FTD and logs of NAT doesn't display the public IP of the users although i can see these public ip addresses from using "show xlate " command.  

2 REPLIES 2
Highlighted
Beginner

Re: logging issues in Cisco FTD

if you look at packet flow through FTD, you can see addition of NAT IP header is after the prefilter/ACP/Snort treatment, so the logs are being sent when it hits the ACP,  which is before the NAT IP header addition (xlate table).

 

Hall of Fame Master

Re: logging issues in Cisco FTD

In addition to what @mohanB correctly noted, you do have the option of configuring a Netflow export using FlexConfig. The NSEL format will include the NATted address.