Non-standard syslog ports on UCS chassis

[MatthewHickey7355]

When configuring a remote server destination for syslog messages on Firepower chassis manager (or any UCS-like chassis for that matter), is it possible to send to another port other than 514? For example, UDP 5145 or something similar?

[Georg Pauwen]

Hello,

check the thread linked below...

https://community.cisco.com/t5/network-security/firepower-change-syslog-port-from-default/td-p/4541594

[MatthewHickey7355]

Thanks, but that thread is talking about the FMC and FTD. I'm talking about the Firepower chassis manager itself. They are different.

[Georg Pauwen]

Hello,

sorry about that...my bad. I (think I) looked extensively at the documentation, there does not seem to be an option directly in the GUI. I wonder what happens if you change the port on the ASA directly:

logging trap x.x.x.x transport udp port 5145

Maybe that affects the FCM...

[MatthewHickey7355]

I checked the CLI and there doesn't appear to be a way to specify a different port other than 514. Cisco documentation states that the default is 514 but it doesn't mention that you are able to modify that setting.

[Georg Pauwen]

Hello,

I think the command is actually:

logging host interface_name ip_address udp/5145

See also the attached screenshot...

[MatthewHickey7355]

Georg, thanks.

But again, I think you are posting solutions that only apply to FTD or ASA. We already have the firewalls sending syslogs on a non-standard port like you have just described.

We are running FPR-9300 security modules that are installed in a physical Firepower chassis (basically like a UCS chassis). I'm looking for a way to configure a non-standard system logging port on the chassis itself (for logs generated by the physical chassis). At this point I'm fairly certain that what I am trying to do isn't supported.

[Georg Pauwen]

Hello,

I think I did a quite extensive search but could not find a way to change the port for the FPR modules either. My idea was that maybe, if you change the logging port on the ASA, it would affect the FPR as well, which apparently is not the case, since you have already changed it on the ASA.