fmc syslog

[shaikh.zaid22]

hi,

i have ftd with fmc running 7.0.1, i have configured the syslog server to send the remote vpn syslogs to a NAC for posture and compliance check. Now the logs are showing up in the NAC, but, in encrypted format not in cleartext.

Kind assistance is required, if anybody knows how to send syslogs in cleartext to external syslog server from fmc.

[marce1000]

 - Are you sure this is not related to the NAC handling of the logs ?

 M.

[balaji.bandi]

what NAC here ?

how is your syslog config TCP or UDP ?

[shaikh.zaid22]

Hi marce and balaji,

Yes it is a forescout NAC, we are configuring for VPN events and then apply compliance policy. However, the logs are not readable. I was wondering whether it is the job of the forescout parser or fmc is sending syslogs in unreadable format.

[balaji.bandi]

personally, never seen this issue before until we missing something here?

[shaikh.zaid22]

We are sending UDP 514 ports.

[Marius Gunnerud]

Syslog from the FMC should not be encrypted, Are you sure you are not using eStreamer?

[shaikh.zaid22]

We have Forescout NAC, wherein we are capturing VPN logs, which is not showing in plaintext.

[Marius Gunnerud]

That is a bit odd, you should be seeing the permit / deny logs received on the "inside" interfaces.  Do you have sysopt connection permit-vpn enabled?  If you have this enabled you could try disabling it, but then be aware that you need to configure access rules on the outside interface for the VPN traffic, and then enable syslog for those rules.