Skip to main content

Cisco ASA

Cisco ASA is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities.

Before you begin, you'll need: Root access to a server running Filebeat with port 6514 open for incoming traffic and 5015 open for outgoing traffic

Configure Cisco ASA Server logging​

Configure your Cisco ASA firewall to send logs to your Filebeat server. Make sure you meet this configuration:

  • Log format: syslog
  • Send over: TCP
  • IP address: Filebeat server IP address
  • Port 6514

See Cisco docs for more information on configuring your Cisco ASA firewall.

Download the Logz.io public certificate​

For HTTPS shipping, download the Logz.io public certificate to your certificate authority folder.

sudo curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o /etc/pki/tls/certs/AAACertificateServices.crt

Add TCP traffic as an input​

In the Filebeat configuration file (/etc/filebeat/filebeat.yml), add TCP to the filebeat.inputs section.

Replace <<LOG-SHIPPING-TOKEN>> with the token of the account you want to ship to.

note

Filebeat requires a file extension specified for the log input.

# ...
filebeat.inputs:
- type: tcp
  max_message_size: 10MiB
  host: "0.0.0.0:6514"

  fields:
    logzio_codec: plain

    # Your Logz.io account token. You can find your token at
    #  https://app.logz.io/#/dashboard/settings/manage-accounts
    token: <<LOG-SHIPPING-TOKEN>>
    type: cisco-asa
  fields_under_root: true
  encoding: utf-8
  ignore_older: 3h

If you're running Filebeat 7, paste this code block. Otherwise, you can leave it out.

# ... For Filebeat 7 only ...
filebeat.registry.path: /var/lib/filebeat
processors:
- rename:
    fields:
    - from: "agent"
      to: "filebeat_agent"
    ignore_missing: true
- rename:
    fields:
    - from: "log.file.path"
      to: "source"
    ignore_missing: true

If you're running Filebeat 6, paste this code block. 

# ... For Filebeat 6 only ...
registry_file: /var/lib/filebeat/registry

Set Logz.io as the output​

If Logz.io is not an output, add it now. (Remove all other outputs - there should only be 1 output in the configuration file.)

Replace <<LISTENER-HOST>> with the host for your region. 

# ...
output.logstash:
  hosts: ["<<LISTENER-HOST>>:5015"]
  ssl:
    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']

Start Filebeat​

Start or restart Filebeat for the changes to take effect.

Check Logz.io for your logs​

Give your logs some time to get from your system to ours, and then open Open Search Dashboards.

If you still don't see your logs, see Filebeat troubleshooting.