Table of Contents
Advertisement
Cisco Firewall Devices (PIX, ASA, and FWSM)
When monitoring a failover pair of Cisco firewall devices, you should designate the primary Cisco
Tip
firewall device as the device to be monitored. If failover occurs, the secondary device assumes the IP
address of the primary, which ensures that session correlation is maintained after the failover. The same
focus on the primary is true for performing any bootstrap operations. The secondary device will
synchronize with the configuration settings of the primary.
To enable administrative connections to the firewall device, select from the following options:
•
•
•
To configure log settings, see
Enable Telnet Access on a Cisco Firewall Device
Log in to the Cisco firewall device with administrator's privileges.
Step 1
Enter the command:
Step 2
telnet <MARS IP address> <netmask of MARS IP address> <interface name>
where interface name can be inside, outside, DMZ.
Enable SSH Access on a Cisco Firewall Device
Log in to the Cisco firewall device with administrator's privileges.
Step 1
Enter the command:
Step 2
ssh <MARS IP address> <netmask of the MARS IP address> <interface name>
where interface name can be inside, outside, DMZ.
Send Syslog Files From Cisco Firewall Device to MARS
When preparing a Cisco firewall device to publish syslog messages, consider the following restrictions:
•
•
To send syslog messages to the MARS Appliance, you must enable logging, select the log facility and
queue size, and specify the log level to debug.
Log in to the Cisco firewall device with administrator's privileges.
Step 1
User Guide for Cisco Security MARS Local Controller
4-4
Enable Telnet Access on a Cisco Firewall Device, page 4-4
Enable SSH Access on a Cisco Firewall Device, page 4-4
Send Syslog Files From Cisco Firewall Device to MARS, page 4-4
Send Syslog Files From Cisco Firewall Device to MARS, page
In releases prior to 4.2.1, do not customize the priority of any syslog messages. If you do, MARS
fails to parse those messages.
Do not configure EMBLEM format for syslog messages. Make sure that the format EMBLEM
extension is not used on the following command in the configuration:
logging host <interface name> <PN-MARS's IP address> format EMBLEM
Chapter 4
Configuring Firewall Devices
4-4.
78-17020-01
Advertisement
Table of Contents
Troubleshooting
