Firepower rule (connection) logging to Syslog question

[corpengineer818]

Firepower rule (connection) logging to Syslog:  When configuring a rule and 'Send Connection Events to', and Syslog is selected, what is source IP of the host sending the Syslog message?  Is it the IP of the Firepower Management Center, or the source IP from the connection itself being logged?

Thank you.

[Marvin Rhoads]

Your FirePOWER Management Center interface sensor's address will be the source IP in the syslog message header. The body of the message should have the addresses specific to the connection record.

[Oliver Kaiser]

I think its actually the sensor that will forward the connection event via syslog. I checked this in the lab with 6.2.0 and saw that syslog was sent directly and not from the FMC.

[Marvin Rhoads]

Thanks for the correction Oliver. An ounce of data is more valuable than a pound of conjecture.

I updated my earlier reply accordingly. 

[corpengineer818]

That makes a lot more sense (that the source is the device/sensor).  Wasn't seeing anything logged from the FMC.  I'll adjust my firewall rules to allow the sensor, and this should work now. 

Thank you.