Cisco Firepower Logging

[mikiNet]

Hello Guys,

I have a question related to logging on Firepower. We have two option to configure it, first via Platform Setting, second via tab in Access Control Policy (this tab is near Security Intelligence, HTTP Response etc.)

Question is: What is difference between logging on Platform Setting vs logging on ACP ? Pros and cons? When using ?

I can't find any good explanation about it.

[balaji.bandi]

As per my understanding. here is what i can describe simple :

Platform Setting - Looging is more related to device logging like errors and events, you can select what kind of logs to be generated and logs to syslog server

Access Control Policy  - Logging - more related to Policy logs ( accept or denined logs ..etc kind). ( you can beging of the connection or ending of the connection, or both)

[mikiNet]

No,

I mean this tab:

[balaji.bandi]

Hope you are using FDM here ?  But yes that is for ACP Logging

[mikiNet]

No, I using FMC. This screenshot is only example what I mean.

So if I enable Logging tab in Access Control Policy I also should enable Logging in Access Control Rule, yes ?

[Marvin Rhoads]

The logging tab in your ACP screenshot primarily refers to syslog setting for those things that have associated syslog actions.

All ACP entries, including the default action, need to have their settings individually set to log or not - it can be to the FMC Connection events, to syslog server or as an SNMP trap. We also choose to log at beginning or end of connection there.

[mikiNet]

Ok, so to log ACP entries I need to set syslog in Logging tab globaly in ACP and also set Logging to syslog server on individual rule (ACE) ? This two configuration need to be done to send syslog messages to syslog server ?

[Marvin Rhoads · Accepted solution]

Yes - but only if you want to use a external syslog server. The majority of my customers log primarily (and only) to the FMC.