Hello, I have a customer that is configuring the CISCO FTD data connector. But they say CISCO FTD documentation shows it support only syslog format. They would like some clarification on the following questions: I. Clarify whether Cisco FTD supports CEF? If it supports only syslog format, are there any dependencies with the CISCO FTD version? Currently, they are ingesting in syslog format but says the syslog format is not the same even for the same type of logs. Basically wants to know if it supports the new CISCO ASA/ FTD solution-based connector and does it support the CEF format?

There are several connectors provided by Cisco. The Cisco ASA connector covers FTD. This does appear to be CEF-based solution.

Cisco FTD data connector

DG001 406 Microsoft Employee

Hello,

I have a customer that is configuring the CISCO FTD data connector.

But they say CISCO FTD documentation shows it support only syslog format.

They would like some clarification on the following questions:

I. Clarify whether Cisco FTD supports CEF?

If it supports only syslog format, are there any dependencies with the CISCO FTD version?

Currently, they are ingesting in syslog format but says the syslog format is not the same even for the same type of logs.

Basically wants to know if it supports the new CISCO ASA/ FTD solution-based connector and does it support the CEF format?

Givary-MSFT 32,501 Reputation points Microsoft Employee

2024-03-28T07:22:37.3633333+00:00

@DG001 Thank you for reaching out to us, let me check on your ask and revert back.
DG001 406 Reputation points Microsoft Employee

2024-05-16T02:32:11.3433333+00:00

The customer is saying that they are getting garbled output from the parser when using the Cisco FTD connector. Any idea why this output is garbled and how to correct this? See below:

Sample Syslog we are receiving:

message repeated 3 times: [ %FTD-2-106016: Deny IP spoof from (0.0.0.0) to 10.16.96.244 on interface RO_GLOBAL_INT_SEG].

Output they are expecting should look like this:

%FTD-6-430003: EventPriority: High, DeviceUUID: f4787322-9fff-11ed-9ab7-a348479cea01, InstanceID: 4, FirstPacketSecond: 2023-02-13T23:05:46Z, ConnectionID: 55951, AccessControlRuleAction: Block, AccessControlRuleReason: Intrusion Block,SrcIP: 10.0.95.10, DstIP: 2.19.32.89, SrcPort: 62725, DstPort: 80, Protocol: tcp,IngressInterface: corporate, EgressInterface: outside, IngressZone: lan-inside,EgressZone: internet, IngressVRF: Global, EgressVRF: Global,

1 answer

Andrew Blumhardt 9,856 Reputation points Microsoft Employee

2024-03-29T14:51:10.3466667+00:00

There are several connectors provided by Cisco. The Cisco ASA connector covers FTD. This does appear to be CEF-based solution.
Please sign in to rate this answer.
DG001 406 Reputation points Microsoft Employee

2024-03-29T19:29:09.8466667+00:00

Thanks Andrew,

The customer is saying they have the connector configured but are getting garbage output from the parser. Do you know why this output is garbled? See below:

Sample Syslog we are receiving:

message repeated 3 times: [ %FTD-2-106016: Deny IP spoof from (0.0.0.0) to 10.16.96.244 on interface RO_GLOBAL_INT_SEG].

Output they are expecting should look like this:

%FTD-6-430003: EventPriority: High, DeviceUUID: f4787322-9fff-11ed-9ab7-a348479cea01, InstanceID: 4, FirstPacketSecond: 2023-02-13T23:05:46Z, ConnectionID: 55951, AccessControlRuleAction: Block, AccessControlRuleReason: Intrusion Block,SrcIP: 10.0.95.10, DstIP: 2.19.32.89, SrcPort: 62725, DstPort: 80, Protocol: tcp,IngressInterface: corporate, EgressInterface: outside, IngressZone: lan-inside,EgressZone: internet, IngressVRF: Global, EgressVRF: Global,

ACPolicy: NG-Access-Policy, AccessControlRuleName: XYZ-INET

Customer statement:

We are ingesting logs through a normal Syslog for pulling logs. Could you please let me know if it supports new CISCO ASA/ FTD solution-based connector and does it support the CEF format?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Cisco FTD data connector

1 answer

Your answer