Overview:

Firewalls can create an enormous about of logging data depending on what you want to track and what you want to keep.  Rather then requiring large disks on the firewalls to store all of those logs, you can send the log traffic off the firewall, and store it on a remote server.  This is also helpful in the event that the firewalls fail, you will likely be sent some amount of data to the remote server to help troubleshoot what went wrong even if the firewall is down. 

All logging can be done with the syslog protocol, and can be sent two ways, with TCP or UDP protocols.  Choosing the right method is critical, because the behavior of the firewall relates to how you send logging data. 

If you send logs over TCP, the firewall will assume that you REQUIRE that all log data is collected, AND IT WILL SHUT DOWN TRAFFIC THROUGH THE FIREWALL IF IT CANNOT CONNECT TO THE LOG SERVER!   With this method, you are guaranteed to log all transmissions, but if your connection to the logging server goes down, or if the logging server overloads/fails/crashes, your firewall will block traffic. 

Note that you can also define what port to send your syslog data over.  The default is udp:514, but it can be set to anything. 

Configuring Local Logging:

The firewalls can log both remotely and localy.  Local logging is limited by storage space, so it is only useful if the logging level is low, but to enable it, you would do the following.

Configuring Remote Logging:

You can have logging data sent to multiple servers, over any desired port.  If you specify transport over the TCP protocol, by default the firewall will block all traffic if it cannot connect to at least one server.  This "feature" can be disabled with the "logg permit-hostdown" command. 

In the following example, we are sending logs to two servers over port TCP:5149.  If the servers do not respond, the firewall will continue because of the "permit-hostdown" line.  The first line is in the format "logging host {outbound-int} {dest-ip} {prot}/{port}"

Debugging Logging Configuring:

To confirm that logging data is being sent properly, you can test with the following methods. 

To confirm that logging is setup and connecting to the syslog server, use the "show logging" command.  Note in this example, we see that the firewall cannot connect to the logging server.

References: