BDO NGIPS Project

INSTALLATION GUIDE HOW TO ENABLE FMC EXTERNAL

SYSLOG
VER 1.0
Contents
BDO NGIPS Project......................................................................................................................................1
INSTALLATION GUIDE How to Enable FMC External SYSLOG.......................................................................1
INTEGRATION OF FMC TO SPLUNK..............................................................................................................3
INSTALLATION GUIDE..................................................................................................................................4
STEP-BY-STEP PROCEDURE..........................................................................................................................5
Back Out Procedure.....................................................................................................................................9
INTEGRATION OF FMC TO SPLUNK

No. Activity Date Time Duration Remarks

1. Configure of FMC EXTERNAL 1 day

SYSLOG

2
3
 REFERENCE NO:
INSTALLATION GUIDE (BR/CRF/IR No.)

SYSTEM NAME VERSION/RELEASE

ENVIRONMENT
FMC ENABLE EXTERNAL SYSLOG
☐ ☒

UAT PROD

REQUIREMENTS FOR INSTALLATION

HARDWARE
[1] – FIREPOWER MANAGEMENT CENTER

SOFTWARE
FMC – 6.2.3 patch 6
STEP-BY-STEP PROCEDURE
1. Login to the FMC web GUI

2. Navigate Devices > Platform Settings>MDC_Platform_Settings

Click the pencil icon to edit the settings

3. Click on Syslog
 On the Logging Setup > click enable logging, send syslog in EMBLEM

4. Click logging Destinations > click add

 On Logging Destinations select Syslog Servers
On Event Class select Filter on Severity & Informational
Click ok

5. Go to Syslog Servers
Click Allow user traffic to pass TCP server syslog is down.
Click add
 Provide ip address of the syslog server
 Select udp
6. Add zones/interface
Zones/interface can be selected on the Objects > interfaces
Click ok, click save
Back Out Procedure
1. Navigate Devices>Platform Settings> MDC_Platform_Settings

2. Click on the Syslog

3. Delete the entry that added on the syslog server

4. Uncheck Allow user traffic to pass when TCP syslog server is down.
5. On the Basic Logging Settings uncheck enable logging, send syslogs in EMBLEM format

6. On logging destinations
Delete the entry syslog destination