- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-05-2020 08:15 AM
I have Cisco NGFW deployed in Azure. Azure doesn't have FMC so we are managing in FTD mode. I am looking to see if there is way to forward local logs from /var/log folder to remote syslog server?
Solved! Go to Solution.
- Labels:
-
NGFW Firewalls
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-14-2020 12:58 PM
There was not way found to forward /var/log/messages but it seems NGFW was sending message using different interface.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-05-2020 10:19 AM
Azure has FMC VA from marketplace. Also, you can use on-prem FMC (physical
or virtual) as long as connectivity is established.
Configure syslogs from FDM is possible as below.
https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-system.html
If you want to forward specific log messages, you can write a python script
to be triggered from FTD expert mode.
***** please remember to rate useful posts
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-06-2020 12:55 PM
As per documentation, I need to use debug level to get command executed by Admin or any config changes. Cisco doesn't recommend continuous debug level.
I see this is Linux OS. Is there a easy way to do syslog forwarding of /var/log files?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-14-2020 12:58 PM
There was not way found to forward /var/log/messages but it seems NGFW was sending message using different interface.
