Hi All,
I know this is an old post, but wanted to add instructions for anyone else who might encounter a need to send Syslog from FTD that is a spoke aka remote office to HQ.
Please note that I believe these instructions work with FMC or cdFMC deployment:
• Under Device Management, select firewall in question and the proceed to the Interfaces tab
• Create a Loopback interface and assign /32 IP address, please make sure that IP address is part of your "interesting traffic" and has necessary NAT exemption in place.
• Under Object - Object Management - Interface, create Interface Group (I called it FW-MGMT) and add the Loopback interface that you created earlier (I am not particularly sure that this step is needed as you technically can later manually enter interface name where the Syslog will originate, but doing this way, there is at least an object in list along with your security zones that you can select without any need of manual entry)
• Then proceed with editing or creating Platform Settings policy under Device Management and make sure that it is assigned to your FTD firewall.
• In Platform Settings policy, configure Syslog section, and select Syslog Servers tab, press Add and then go about specifying Ip address of the Syslog server and for the "Reachable By" select "Security Zones or named Interfaces" and specify Interface Group you created earlier, FW-MGMT in my case and press OK.
• Now it is necessary to ensure that you have Access Control Policy (ACP) rule in place that allows the traffic to the the Syslog server. I recall that I created wide open rule for my S2S VPN traffic without specifying Source Security Zone or Source Network, but did specify that traffic is allow as long it is going to the Syslog server on Syslog port. If you need to be more specific, then you might need to do some debug to see what is actual Source Security Zone for this traffic.
With the above config, you should be getting Syslog messages that relate to firewall itself and not the ACP rule hits, to get ACP rule hits to be logged, there is an extra steps to be done:
• Edit your ACP and under More where you see Advanced Settings, HTTP Response, Inheritance Settings, select Logging and then place a tick against "Use the syslog settings configured in the FTD Platform Settings policy deployed on the device"
• Go about configuring any ACP rule that requires that logs are sent over tot he Syslog server
Now along with the firewall logs, you should get the ACP rule hits as well.
Loopback as a source does require that you are running version 7.3 or later.
Hope this helps others as I spent a month with TAC who where trying to configure cdFMC managed FTD to send Syslog's using Management Interface that resulted in FTD connection been lost between the cdFMC, pushing out numerous Flex configs and in the end got closed down as they did not get what we were after, having FTD's sftunnel established over Outside data interface and still have means to receive syslog at HQ.
This same Loopback interface can be used for SSH access as long you configure the Platform Settings for it.
