FTD logging to Algosec

[Marius Gunnerud]

Has anyone here set up logging from FTD to Algosec?  The only documentation I have found on the Algosec site with regards to logging was for ASA and there it stated that syslog message ID 106100 is needed.  This syslog ID is not available in FTD after 6.2. So I am wondering if anyone has successfully set up logging towards Algosec and which syslog message IDs were used?

[1_am_r00t]

Not using Algosec, running into a similar problem though. Have you ever managed to fix/solve it?

[Marius Gunnerud]

Yes, solved this by enabling logging to syslog server under each ACP rule.  Once I did this syslog was sent.

[1_am_r00t]

Interesting. I have enabled logging for the majority of ACP rules (see screenshot attached), however, 106100 is not being sent. Maybe it is version specific - we're using 6.6.5.2 in this deployment.

[Marius Gunnerud]

FTD doesn't use 106100, it uses the following:

430002 - log at beginning

430003 - log at end