Cisco ASA

About the Device

The Cisco Adaptive Security Appliance is an integrated security equipment that can perform a variety of functions like firewall, intrusion prevention, VPN, content security, unified communications, and remote access.

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

Log collection from ASA devices via WEB UI:

1. Logon to Cisco ASDM –IDM Launcher  console

2. Navigate to Configuration -> Device Management -> Logging -> Syslog Servers ->Add

3. At Add Syslog Server window, set the below parameters:

   1. Interface should be set to Manage

   2. Enter Syslog server IP at the IP address.

   3. Select protocol as TCP

   4. Set port number as 601 at Port

4. Click on OK, then select Apply                            

Log collection from ASA devices via CLI:

Use the configuration tools that are provided with Cisco ASA to complete the following steps:

1. Set the Cisco log severity level.

   When you select the appropriate severity level, you need to balance the need for detailed log information against additional network traffic and disk space that is used by the log data.
   Severity levels range from 0 (for emergency messages only) to 7 (the highest severity level, used primarily for debugging). Each level includes the levels below it. For example, severity level 4 includes all log messages of severity 0-4.
   The following are the types of messages that can occur along with their severity level: 

   • Severity level 1 Alert Messages

   • Severity level 2 Critical Messages

   • Severity level 3 Error Messages

   • Severity level 4 Warning Messages

   • Severity level 5 Notification Messages

   • Severity level 6 Informational Messages

   • Severity level 7 Debugging Messages

2. Disable Cisco EMBLEM format logging, if it is enabled. The EMBLEM format is not supported.

3. Enable Cisco syslog event forwarding.

To configure the Cisco device to work via CLI:

1. To enter configuration mode on the Cisco device, complete the following steps:

   1. Log on to the Cisco device.

   2. At the prompt, type the following command: enable

   3. Enter your privileged command mode password.

   4. At the new prompt, type the following command: configure terminal.

2. To set the Cisco log severity level, at the prompt, type the following command:

   logging trap severity_level

3. To disable Cisco EMBLEM format logging, type the following command:
   At the prompt, type the following command:

   no logging emblem

4. To enable Cisco syslog event forwarding, complete the following steps:

   logging host interface_name IP_address tcp/601

   where:

   1. interface_name is the Cisco ASA or PIX network interface that is used to send

   2. the syslog messages IP_address is the IP address of the computer that receives the syslog messages

   3. AMxDR recommends TCP protocol.

   4. port_number is the syslog port number preceded by a /

   5. An example command that uses TCP as the syslog protocol and port 601 is as follows:

   6. An example command that uses a port other than 514 is as follows:

Integration Parameters

Parameters required from customer for Integration.