Skip to content Skip to main navigation Skip to footer
Wavecrest Knowledge Base

Tag: Cisco ASA

Configure Syslog on Cisco ASA with FirePOWER Firewalls

Category: Administration

To configure your Cisco ASA with FirePOWER  firewall to send web traffic syslog messges to your syslog server, you need to define the syslog server and apply syslog logging to your access control and SSL policies.

Define Syslog server in Cisco ASA w/FirePOWER

  1. To configure a Syslog Server for traffic events, navigate to Configuration | ASA Firepower Configuration | Policies | Actions Alerts and click the Create Alert drop-down menu and choose option Create Syslog Alert.
  2. Enter the following values for the Syslog server installed (see step 1 above).
    • Name: Specify a name to uniquely identifies your Syslog server such as ‘Kiwi Syslog Server’
    • Host: Specify the IP address/hostname of the Syslog server.
    • Port: Specify the port number your Syslog server is listening on. 514 is the default syslog server port.
    • Facility: Select any facility such as SYSLOG
    • Severity: Select Informational
    • Tag: Leave blank.

Apply Syslog to Access Control Policies

  1. Select Configuration | ASA FirePOWER Configuration | Policies | Access Control Policy.
  2. On the Rules tab, click the Edit icon next to the access control policies that apply to your network’s Internet usage. For each policy:
    1. Go to the Logging tab and select Log at Beginning and End of Connection
    2. In the Send connection events to section, check Syslog and select your syslog server (defined above)
    3. Click OK.
  3. Select the Advanced tab and click the edit icon next to General Settings.
  4. Change the Maximum URL characters to store in connection events to 4096 (this is the maximum number of characters to store for URLs) and click OK.
  5. Click Store ASA FirePOWER Changes to save your changes.

Apply Syslog to SSL Policies

  1. Select Configuration | ASA FirePOWER Configuration | Policies | SSL
  2. On the Rules tab, click the Edit icon next to the SSL policies that apply to your network’s Internet usage. For each policy:
    1. Go to the Logging tab and select Log at End of Connection
    2. In the Send connection events to section, check Syslog and select your syslog server (defined above)
    3. Click OK.
  3. Click Store ASA FirePOWER Changes to save your changes.

Cyfin Syslog server should start receiving log messages and logging them to text files.

Additional Resources