Use https://seceonhelp.freshdesk.com/support/login to access updated Knowledge Base Articles, Submit Technical Support Tickets and Review Status of submitted support tickets.

Configuring syslog export from Cisco ASA / Cisco PIX through CLI

Telnet to the firewall and enter the enable mode

Type the following:
configure terminal
logging on
logging timestamp
logging trap informational
logging device-id {context-name | hostname | ipaddressinterface_name | string text}
logging host interface_namesyslog_ip [17/<syslog_port>


where,

interface_name:

is the interface on the firewall whose logs need to be analyzed ("inside" or "outside," for example).

syslog_ip:

is the IP address of the syslog server (CCE host’s IP address) to which the ASA firewall should send the Syslogs.

17/<syslog_port>:

indicates that logs will be sent using the UDP protocol, to the configured syslog port on the syslog server. If left blank, the syslogs are sent through the default syslog port (UDP port 514). If the logs are sent through any other port, mention it as 17/<the UDP port number> (For example: 17/1514).

Hostname:

firewall's host name (defined with the hostname configuration command). In this case, the hostname will appear in the logs sent from the Firewall.

ipaddressinterface_name:

the IP address of a specific firewall interface named interface_name ("inside" or "outside," for example). In this case, the IP Address of the Interface Namewill appear in the logs sent from the Firewall.

string text:

an arbitrary text string (up to 16 characters). In this case, the arbitrary text string you have entered in string <text> will appear in the logs sent from the Firewall.

context-name:

operating in multiple-context mode, the name of the firewall context will appear in the logs sent from the Firewall.


Example: logging host inside 11.23.4.56 17/1514

To verify your configuration, enter the show logging command after the last command above. This will list the current logging configuration on the firewall.

Seceon Inc. All rights reserved. https://www.seceon.com