Follow these instructions to send logs from Cisco Pix or ASA firewalls.
Sending logs from Cisco PIX or ASA firewalls is a multi-step process:
Configure logging on the device
Capture the activity on the NAT table
Forward it to the Comm Broker via syslog as follows:
# config t (config) # logging on (config) # logging host (IP ADDRESS OF COMM BROKER) (config) # logging trap 6 (informational) (config) # service timestamps log datetime
Each line in the access control lists (ACLs) should end with the keyword "LOG." Each ACL should end with a default statement to deny all traffic, and log:
# deny IP any any LOG
Cisco ASA firewalls will send UDP, by default. If you choose to send syslog using TCP, be sure to add the commands that allow it to operate even if the syslog receiver (Comm Broker) is unavailable. It will fail closed by default, and not pass traffic.
(config) # logging permit-hostdown
More Cisco logging information is available from the Cisco website:
http://www.cisco.com/en/US/docs/security/asa/syslog-guide/asa-syslog.pdf