How to Configure Firewall Syslog Forwarding Correctly — Fortinet, Palo Alto, Cisco
Step-by-step guide to configuring Syslog forwarding on FortiGate, Palo Alto, Cisco ASA, and Sophos firewalls, plus the 5 most common mistakes and fixes.
How to Configure Firewall Syslog Forwarding Correctly — A Log Management Connection Guide
Collecting logs from your firewall is the foundation of any log management setup — but many organizations get the configuration wrong, resulting in missing logs, incomplete logs, or logs sent in the wrong format. This guide covers how to set up Syslog on the firewall brands most commonly used in Thailand.
What Is Syslog?
Syslog is the standard protocol for sending logs from network devices to a log server. It supports both UDP (port 514) and TCP (port 514/6514), and comes in two versions:
| Version | RFC | Characteristics |
|---|
| Syslog Legacy | RFC 3164 | Older format, carries priority + message fields |
| Syslog Modern | RFC 5424 | Newer format with structured data and precise timestamps |
💡 Recommended: Use RFC 5424 + TCP + TLS for maximum security and reliability.
How to Configure Syslog on Popular Firewalls
1. Fortinet FortiGate
config log syslogd setting
set status enable
set server "10.0.0.100"
set port 514
set mode reliable
set facility local7
set source-ip "10.0.0.1"
end
What to configure:
server = the IP address of your log server (e.g., zcrLog)mode reliable = use TCP per RFC 6587 instead of UDP (renamed from reliable enable as of FortiOS 6.0)facility = local7 (separates these logs from other sources)
2. Palo Alto Networks
Via the Web UI:
- Go to Device → Server Profiles → Syslog
- Add a new Server Profile
- Enter the log server's IP address, port 6514 (the standard port for SSL), and set Transport to SSL
- Go to Objects → Log Forwarding Profile
- Select the log types: Traffic, Threat, URL, WildFire
- Choose the Syslog profile you just created
- Apply it to every Security Rule
3. Cisco ASA
logging enable
logging host inside 10.0.0.100
logging trap informational
logging device-id hostname
logging timestamp
4. Sophos XG
Via the Web UI:
- Go to System Services → Log Settings
- Add a Syslog server: IP address, port, Protocol = TCP
- Select the log types: Firewall, IPS, Web, Authentication
5 Common Mistakes
| # | Problem | Fix |
|---|
| 1 | Using UDP — logs get dropped under network congestion | Switch to TCP or TCP+TLS |
| 2 | Timestamps aren't configured | Enable NTP sync on the firewall |
| 3 | Only Traffic logs are being sent | Add Threat, Auth, and System logs |
| 4 | Firewall's source IP isn't set | Set source-ip in the Syslog config |
| 5 | Log server disk fills up | Set a retention policy and alert at 80% usage |
⭐ zcrLog Accepts Syslog From Any Firewall That Can Export It
zcrLog isn't limited to specific brands — any firewall that exports standard Syslog can send to zcrLog. Format auto-detection is already live for:
- ✅ Fortinet FortiGate
- ✅ Palo Alto Networks
- ✅ Cisco ASA / Firepower
- ✅ Sophos XG / XGS
Other vendors (Juniper SRX, Check Point, pfSense/OPNsense, etc.) can send Syslog too — they just don't have vendor-specific format auto-detection yet, so logs are stored as generic Syslog.
🎯 See zcrLog →
📞 Free Consultation
Related articles
Continue with these related guides for the comparison and operating detail:
Related product
See zcrLog for the product scope, the pricing page for published prices, and the inputs to confirm with your delivery partner
Sources
- RFC 5424 — The Syslog Protocol — confirms the difference between Syslog Legacy (RFC 3164) and Syslog Modern (RFC 5424), including TLS transport using TCP port 6514
- Fortinet — config log syslogd setting (FortiOS CLI Reference) — confirms the current syntax for configuring reliable TCP syslog on FortiOS 6.0 and later
- Palo Alto Networks — Device > Server Profiles > Syslog — confirms the standard port per transport type (UDP 514, SSL 6514)