Showing results for 
Search instead for 
Did you mean: 

Carp multicast traffic not visible in Connection Events on FMCv


Hello everyone,
Maybe this is a strange question:
I have a firepower 7115 with inline pair in and out between two non Cisco firewalls which are running carp interfaces.
I have checked the connection events on the FMC but can’t see the multicast carp traffic(heartbeat).
When I make a capture on the firepower I can see the traffic passing through the box as expected. (Source IP Interface of master -> DestIp 224.0.018)
Can someone explain why this traffic isn’t logged by the firepower ?

2 Replies 2

Cisco Employee
Cisco Employee

Good morning @BastiiGee .

Can you please give more details on the topology (what interfaces are connected to what, how they are configured, etc..).

Also, remember that for the traffic to be logged and seen in the connection events, you must enable logging for the specific access control entry.


You can also learn more about Cisco Secure Firewall (formerly known as NGFW) through our live Ask the Experts (ATXs) session. Check out Cisco Network Security ATXs Resources [] to view the latest schedule for upcoming sessions, as well as the useful references, e.g. online guides, FAQs.

Good morning @lciccar,

Thank you for your message and your questions on my initial question.
I was able, through some trial and error + reading, to understand why I could not see the muticast traffic.
The logging was activated for that particular traffic. However, on my slightly older Firepower 7115, it only logs at the start or end of a connection but not the constant stream.
So it is not possible to see the traffic after initialization or before termination of the connection.




Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: