I'm having an issue with Cisco Firepower Syslog, for some reason, I get the Syslog from the FMC with (null) in the place where the sender FTD IP or hostname should be.

I'm using a pure Firepower installation (not an upgrade from ASA) version 6.3.0 and I have another setup with the same problem of version 6.2.3.

The Syslog is looking like this:

Nov  6 15:05:02 (null) : %FTD-7-430002:Protocol: icmp, SrcIP:, DstIP:, ICMPType: Echo Request, ICMPCode: No Code, Policy: Default, ConnectType: Start, AccessControlRuleName: shay_traffic_test, AccessControlRuleAction: Allow, Prefilter Policy: Default Prefilter Policy, UserName: No Authentication Required, Client: ICMP client, ApplicationProtocol: ICMP, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 98, ResponderBytes: 0, NAPPolicy: Balanced Security and Connectivity

Have anyone came across such a problem? Does anybody know how can I fix this?

  • is there anyone? – Zorik Meyman Nov 18 '18 at 8:10
  • Are you sure that the payload of the syslog contains the "null", versus what the syslog server is appending to the beginning of it? Perhaps try to Wireshark or tcpdump one syslog message to see if that's really in the payload or if it's getting appended by the syslog collector. – user3629081 Jan 13 '19 at 3:08
  • I took the syslog from tcpdump, i can attache the full tcpdump message if you what.... – Zorik Meyman Jan 14 '19 at 7:29
  • Yes, please either post the pcap file or a screenshot of the pcap in Wireshark. – user3629081 Jan 16 '19 at 1:40
  • unfortunately, the original file was deleted, but here is a pcap file for another traffic but with the same problem link to file: drive.google.com/file/d/1DtFkDuibt-vzI30-T5rTik8Ey0CqjvLf/… – Zorik Meyman May 15 '19 at 13:12