topic Re: Using Identity Awareness Collector with Cisco FTD Syslogging in General Topics

Using Identity Awareness Collector with Cisco FTD Syslogging

Heath — Thu, 18 Sep 2025 18:04:25 GMT

We currently have Cisco ASA's as VPN Concentrators and have syslogging to a CP IDA Collector to populate the identities for access rules on our CP firewalls.

We are migrating from the Cisco ASA's to Cisco FTD's and are having issues. We've verified the IPs and verified the traffic is getting allowed to the IDA Collector but it doesn't look like the CP IDA Collector is parsing out any identities from the Cisco FTD's syslogs. When migrating to the Cisco FTD's we are using the same syslog events as was configured and working on the ASA's as well.

In CP IDA there is only the option for Cisco ASA 9.1 on the syslog options and not anything for the FTD but I'd be surprised if there are differences in the format as you can still get to the ASA CLI under the hood of the FTD code.

I'm only assuming that we aren't the only ones to do this as the FTD's have been out there for a good bit.

Has anyone else got experience with this setup?

Re: Using Identity Awareness Collector with Cisco FTD Syslogging

Heath — Thu, 18 Sep 2025 21:56:39 GMT

Re: Using Identity Awareness Collector with Cisco FTD Syslogging

Heath — Mon, 22 Sep 2025 17:42:57 GMT

No one using IDA Collectors with Cisco FTDs?

Re: Using Identity Awareness Collector with Cisco FTD Syslogging

CaseyB — Mon, 22 Sep 2025 20:09:20 GMT

Have you tried creating a new Syslog Parser for the FTD?

Re: Using Identity Awareness Collector with Cisco FTD Syslogging

Heath — Mon, 22 Sep 2025 20:11:47 GMT

That would certainly be my last resort. No, we have not gone down that road yet. We were hoping this was something someone had already overcame and we just had a setting wrong or something. I can't see anything wrong except for, like you were saying, maybe we need a custom parser for this.

Re: Using Identity Awareness Collector with Cisco FTD Syslogging

Heath — Fri, 26 Sep 2025 20:23:48 GMT

Ended up creating a custom syslog parser. Here are the settings:

Parser Name : "Cisco FTD (7.6)"
Message Subject : "<148>"
Event Type : "Login"
Delimiter : ">"
Username Prefix : " User <"
Username : "([^>]*)"
Address Prefix : " IPv4 Address <"
Address : "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"