firewall.cisco

The tags beginning with firewall.cisco and vpn.cisco identify log events generated by the following Cisco technologies:

• Cisco ASA

• Cisco ASA VPN

• Cisco Firepower Threat Defense

• Cisco Firepower Management Central

• Cisco PIX 

• Cisco Firewall Services Module

Firewall Cisco together with Firepower and VPN

Tag structure

The full firewall.cisco tags have just three levels. The first two are fixed as firewall.cisco.  The third level identifies the technology type and must be one of asa, ftd, fmc, fwsm, or pix. 

For the Cisco ASA AnyConnect VPN events, there is just one tag vpn.cisco.asa.anyconnect.

Therefore, the valid tags include:

• firewall.cisco.asa

• firewall.cisco.fmc

• firewall.cisco.ftd

• firewall.cisco.fwsm

• firewall.cisco.pix

• vpn.cisco.asa.anyconnect

For more information, read more about Devo tags.

Cisco Firewall Configuration

The Cisco firewall can be configured to report its logs to a remote syslog server, in this case, the Devo relay. To configure this using Cisco's Adaptive Security Device Manager (ASDM), follow the vendor instructions.

In order to get all your events in your Devo domain, you must add the hostname to your syslog events by executing the following command:

Learn more about this process here. 

Devo relay rules

You will need to define relay rules that can correctly identify the event type and apply the corresponding tag.

We'll use mostly type-2 relay rules that apply a fixed tag based upon specific data contained in the inbound event and all rules are defined on the same port. In this example, we're using port 13007, but you can use any free port on your relay. The last rule is a type-1 rule and applies the firewall.cisco.asa tag to any event that didn't match the previous rules.

These instructions cover all of the event types and the order is important. Even if you are only sending some of the Cisco firewall event types to Devo, be sure to follow the same order.

Rule 1: Cisco Firepower Threat Defense events

• Source port → 13007

• Source data → %FTD-

• Target tag → firewall.cisco.ftd

• Select the Stop processing and Sent without syslog tag checkboxes

Open

Rule 2: Cisco Firepower Management Central events

• Source port → 13007 

• Source data → FMC

• Target tag → firewall.cisco.fmc

• Select the Stop processing and Sent without syslog tag checkboxes

Open

Rule 3: Cisco Firewall Services Module events

• Source port → 13007

• Source data → %FWSM-

• Target tag → firewall.cisco.fwsm

• Select the Stop processing and Sent without syslog tag checkboxes

Rule 4: Cisco PIX events

• Source port → 13007

• Source data → %PIX-

• Target tag → firewall.cisco.pix

• Select the Stop processing and Sent without syslog tag checkboxes

Rule 5: Cisco ASA VPN events

This rule must precede the Cisco ASA rule. The regex in the Source Data field identifies all event codes associated with the VPN.

• Source port → 13007

• Source data →  ASA-[0-9]+-(?:722010|722036|113039|716059|722012|716058|716002|722033|722034|722037|722023|722028|722032|722051|722055|722022|722041)

• Target tag → vpn.cisco.asa.anyconnect

• Select the Stop processing and Sent without syslog tag checkboxes

Rule 6: Cisco ASA events

All events received on this port that did not match any of the previous rules will be assigned the firewall.cisco.asa tag.

• Source port → 13007

• Target tag → firewall.cisco.asa

• Select the Stop processing and Sent without syslog tag checkboxes

Firepower through eStreamer eNcore CLI

Tag structure

This technology uses a single tag to support all the Firepower Management Center events. The tag is simply firewall.cisco.fmc_estreamer and the associated events are saved in Devo in a table of the same name.

For more information, read more about Devo tags.

eStreamer eNcore CLI Configuration

The eStreamer eNcore CLI can be configured to report its logs to a remote syslog server, in this case, the Devo relay. Note that you must select JSON as the output.

To configure it, follow the vendor instructions.

Devo relay rule

You will need to define a relay rule that can correctly identify these events and apply the corresponding tag.

We'll use a rule that applies a fixed tag based upon this data arriving at a defined port, in this case, 13011, but you can use any free port on your relay.

• Source port → 13011

• Target tag → firewall.cisco.fmc_estreamer

• Select the Stop processing checkbox