Cisco Firepower

To use Firepower Management Console to connect a firewall running Firepower Threat Defense (FTD) version 6.3 or later to your Sophos appliance, do as follows.

Configure syslog settings

1. In FMC, click Devices > Platform Settings.
2. Select the platform you want to connect to the appliance and click the edit icon.
3. Click Syslog.
4. Click Syslog Servers > Add.

5. Enter the following connection details for your Sophos appliance.

   1. IP address. This is the syslog IP address you set in Sophos Central.
   2. Protocol type. If you selected UDP, you must not turn on EMBLEM format.
   3. Port number.

   You must enter the same settings you entered in Sophos Central when you added the integration.

6. Don't select Enable secure syslog.

7. In Reachable By enter the network details that allow your firewall to reach the Sophos appliance.

8. Click OK.

   For more information about syslog server settings for Cisco Firepower firewalls, see Configure a Syslog Server.

9. Click Syslog Settings and configure the settings as follows:

   1. Turn on Enable timestamp on Syslog Messages.
   2. In Timestamp Format select RFC 5424.
   3. Turn on Enable Syslog Device ID and select Host Name.
   4. Don't turn on Netflow Equivalent Settings.

10. Click Save.

11. Click Logging Setup.
12. Select Enable Logging.

13. You must not select the following:

    1. Enable logging on the failover standby unit
    2. Send syslogs in EMBLEM format
    3. Send debug messages as syslogs

14. If you want to forward VPN events to the Sophos appliance, do as follows:

    1. In the VPN Logging Settings section, select Enable Logging to Firewall Management Center.
    2. Choose Debug as the Logging Level.

15. You don't need to enter information for Specify FTP Server Information or Specify Flash Size.

16. Click Save.

Configure logging settings for access control

You must also configure logging settings for the access control policy, including file and malware logging.

To do this, do as follows.

1. Click Policies > Access Control.
2. Click the edit icon for the access control policy you want to configure.
3. Click Logging.
4. Select Use the syslog settings configured in the FTD Platform Settings policy deployed on the device.
5. In Syslog Severity, select ALERT.
6. Turn on Send Syslog messages for IPS events.
7. Turn on Send Syslog messages for File and Malware events.
8. Click Save.

Turn on logging for Security Intelligence events

1. In the same access control policy, click Security Intelligence.
2. Click the DNS Policy options icon.

3. In DNS Blacklist Logging Options, turn on the following:

   • Log Connections.
   • Firewall Management Center
   • Syslog Server.

4. Click OK.

5. In Blacklist, click the Network options icon.

6. In Network Blacklist Logging Options turn on the following:

   • Log Connections
   • Firewall Management Center
   • Syslog Server

7. Click OK.

8. Scroll down in Blacklist to find the URL options icon.

9. In URL Blacklist Logging Options turn on the following:

   • Log Connections
   • Firewall Management Center
   • Syslog Server

10. Click OK.

11. Click Save.

Turn on syslog logging for each access control rule

You must make sure that every rule in the access control policy has syslog logging turned on.

To do this, for every rule in the policy, do as follows.

1. In the same access control policy, click the Rules tab.
2. Click a rule to edit it.
3. In Editing Rule click Logging.

4. Choose whether to log the start or end of connections, or both.

   Connection logging generates a lot of data. Logging both start and end generates roughly twice as much. Not all connections can be logged both at start and end. For more details, log into your Cisco account and go to the Connection Logging section of the Firepower Management Center Configuration Guide, Version 6.2. See Connection, Logging.

5. If you want to log file events, select Log Files.

6. Turn on Syslog Server.
7. Click Save.

Turn on logging for intrusion events

You must also turn on event logging in the intrusion policy that's associated with your access control policy.

1. Click Policies > Intrusion.
2. Find the intrusion policy associated with your access control policy and click Snort 2 Version.
3. In Policy Information click Advanced Settings.
4. In Advanced Settings go to Syslog Alerting.
5. Click Enabled.
6. Click Back.
7. In Policy Information click Commit Changes.
8. Enter a description of the changes and click OK.

To connect a Firepower device to your Sophos appliance using FDM, do as follows.

Turn on logging for file and malware events.

To turn on logging for file and malware events and add the connection details of your Sophos appliance to the firewall, do as follows.

1. Sign in to FDM on the device you want to configure and go to the Device:<name> tab.
2. In System Settings click Logging Settings.
3. Turn on FILE/MALWARE LOGGING.
4. Click Syslog Server to see the available servers.
5. If you've already added your Sophos appliance to this device, select it. If not, click Create new Syslog Server.

6. Enter the following connection details for your Sophos appliance.

   1. IP address. This is the Syslog IP address you set in Sophos Central.
   2. Protocol type.
   3. Port number.

   You must enter the same settings you entered in Sophos Central when you added the integration.

7. If necessary, select a Data Interface or Management Interface to suit your network environment.

8. Click OK.
9. Your new server appears in Syslog Servers. Click it to select it.
10. In Log at Severity Level select Debug.
11. Click SAVE.

Configure policies

In each policy, you must turn on logging for the activities you want to send to your Sophos appliance. You can turn on access control and intrusion events.

To do this, do as follows.

1. Click Policies > Access Control.
2. Find the policy you want to configure and click the edit icon.
3. Click Logging.
4. In SELECT LOG ACTION choose whether you want to log at the beginning or end of connections, or neither.
5. In FILE EVENTS turn on Log Files
6. If you want to log intrusion events, in Intrusion Policy turn on INTRUSION POLICY.
7. Select the Intrusion Policy you want to apply.

8. If you want to log file events, in File Policy select the file policy you want to apply. Choose from:

   • Block Malware All
   • Malware Cloud Lookup - No Block

9. In SEND CONNECTION EVENTS TO: select your Sophos appliance.

10. Click OK.
11. Click Intrusion.
12. Find the policy you want to configure and click the settings icon.
13. In Edit Logging Settings click the plus icon and select your Sophos appliance.
14. Click OK.

Repeat these steps for each policy that should send data to your Sophos appliance.

Save your changes

Your changes aren't active on the device until you deploy them. To do this, do as follows.

1. Click the Deployment icon.

   The dot on the icon appears when you have undeployed changes.

2. In Pending Changes review the changes.

3. Click DEPLOY NOW.

For more details on this process refer to the Cisco documentation. See Creating a Syslog Alert Response.

To connect Firepower classic devices to your Sophos appliance, do as follows.

Configure syslog settings

1. Sign in to your Firepower Management Center (FMC).
2. Click Policies > Actions > Alerts.
3. In Create Alert, select Create Syslog Alert.
4. Enter a Name for the alert, for example SophosIntegration
5. Enter the IP address of your Sophos appliance in Host.
6. Enter the port configured on your Sophos appliance in Port.

7. Select the Facility.

   The Sophos appliance accepts any facility data. You can find the list of data options in the Cisco documentation. See Table 1. Available Syslog Facilities.

8. Select the Severity level.

   The Sophos appliance accepts any severity level you choose. You can find the list of options in the Cisco documentation. See Table 2. Syslog Severity Levels.

9. Click Save.

When you turn on Send Audit Log to Syslog and provide Host information, syslog messages are sent to the host as well as audit logs. If you want to change this, you can find out how in the Cisco documentation. See Filter Syslogs from Audit Logs.

Configure syslog settings for access control

1. Sign in to your device.
2. Click Policies > Access Control.
3. Edit the applicable access control policy.
4. Click Logging.
5. Select Send using specific syslog alert.
6. Select the syslog alert you created above.
7. Click Save.

Turn on logging for file and malware events

1. Select Send Syslog messages for File and Malware events.
2. Click Save.

Turn on logging for intrusion events

1. Go to the intrusion policy associated with your access control policy.
2. In your intrusion policy, click Advanced Settings > Syslog Alerting > Enabled.
3. Click Back.
4. In Policy Information click Commit Changes.
5. Enter a description of the changes and click OK.