FMC Audit Log/Syslog over TLS Port configuration

[Ralf Wieseke]

Hi Community,

I have configured a syslog server for Audit Logs on my FMC with TLS enabled. The FMC is sending messages on TCP 6514 but the syslog server is only accepting TCP 9140.

Is it possible to change the Port on FMC?

Syslog for the FTDs is working fine over TCP 9140

Regards,

Ralf

[MHM Cisco World]

MHM

[Marvin Rhoads]

Unfortunately, for an FMC sending syslog over TLS, the destination port (6514/tcp) is not configurable.

See table 3 here:

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/740/management-center-admin-74/reference-ports.html

[ccieexpert]

you might be able to use a hack to do a destination NAT to NAT the port.. but it is a hack.. i would just change the syslog server to accept it on a different port.