To set up Cisco FTD collector, do the following:
- Enable Cisco FTD collector
- Install the XDR Collector
- Configure Cisco FTD
- Open the port on the XDR Collector Host
Enable Cisco FTD collector
- In Barracuda XDR Dashboard, navigate to Administration > Integrations.
- On the Cisco FTD Collector card, click Setup.
- Select the Enabled check box.
- Click Save.
Install the XDR Collector
- If you haven't already set up the XDR Collector, do one of the following:
Configure the Firewall
- Log in to your Firepower Managed Center console.
- Click Devices.
- Click Platform settings.
- Navigate to Threat Defense Policy > Syslog > Syslog Servers.
- For Protocol, select UDP.
- For Port, type 9222.
- To save the configuration, click OK and Save.
- To save the platform, click Save.
- Select Deploy.
- Choose the FTD appliance where you want to apply the changes.
- Click Deploy.
Open the Port on the XDR Collector Host
Ensure incoming traffic is allowed on UDP port 9222.
Linux
sudo ufw allow 9222/udp
Windows
netsh advfirewall firewall add rule name="Cisco FTD Firewall Events" dir=in action=allow protocol=UDP localport=9222