|
| 1 | +## Overview |
| 2 | + |
| 3 | +[Cisco Secure Client][4] (formerly AnyConnect) provides secure, encrypted VPN access for users connecting to internal resources. It ensures reliable remote connectivity, and handles sessions, licensing, and client version compatibility to maintain consistent security across multiple devices. |
| 4 | + |
| 5 | +Integrate Cisco Secure Client with Datadog to gain insights into AnyConnect logs using pre-built dashboard visualizations. Datadog uses its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. The integration can also be used for Cloud SIEM detection rules for enhanced monitoring and security. |
| 6 | + |
| 7 | +**Minimum Agent version:** 7.77.0 |
| 8 | + |
| 9 | +**Disclaimer**: Your use of this integration, which may collect data that includes personal information, is subject to your agreements with Datadog. Cisco is not responsible for the privacy, security or integrity of any end-user information, including personal data, transmitted through your use of the integration. |
| 10 | + |
| 11 | +## Setup |
| 12 | + |
| 13 | +### Configuration |
| 14 | + |
| 15 | +#### Enable log collection |
| 16 | + |
| 17 | +1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the `datadog.yaml` file with: |
| 18 | + ```yaml |
| 19 | + logs_enabled: true |
| 20 | + ``` |
| 21 | +
|
| 22 | +2. Add the following configuration block to your `cisco_secure_client.d/conf.yaml` file to start collecting your Cisco Secure Client logs: |
| 23 | + |
| 24 | + ```yaml |
| 25 | + logs: |
| 26 | + - type: tcp # or udp |
| 27 | + port: <PORT> |
| 28 | + service: cisco-secure-client |
| 29 | + source: cisco-secure-client |
| 30 | + log_processing_rules: |
| 31 | + - type: include_at_match |
| 32 | + name: include_anyconnect_logs |
| 33 | + pattern: .*(AnyConnect|anyconnect|113038|113039|734001|751025|722053|722054).* |
| 34 | + ``` |
| 35 | + |
| 36 | + See the sample [`cisco_secure_client.d/conf.yaml`][6] for available configuration options. |
| 37 | + |
| 38 | + **Note**: Do not change the `source` and `service` values, as these parameters are integral to the pipeline's operation. |
| 39 | + |
| 40 | +3. [Restart the Agent][3]. |
| 41 | + |
| 42 | + |
| 43 | +<br> |
| 44 | + |
| 45 | +**Note**: To forward Cisco Secure Client logs, you must configure syslog on the Cisco firewall platform that you're using with Cisco Secure Client (FTD, Meraki, or ASA; see below for instructions for each platform). |
| 46 | + |
| 47 | +</br> |
| 48 | + |
| 49 | +#### Configure Syslog on Cisco FTD Firewall using FMC |
| 50 | + |
| 51 | +1. Connect to the Cisco Firewall Management Center (FMC) platform. |
| 52 | +2. Select **Devices** > **Platform Settings** and create or edit an FTD policy. |
| 53 | +3. Select **Syslog** > **Logging Setup**. |
| 54 | + 1. Check the **Enable Logging** checkbox. |
| 55 | + 2. Click **Save**. |
| 56 | +4. Select **Syslog** > **Syslog Settings**. |
| 57 | + 1. Check the **Enable Timestamp on Syslog Messages** checkbox. |
| 58 | + 2. Select **RFC 5424 (yyyy-MM-ddTHH:mm:ssZ)** from the Timestamp Format dropdown list. |
| 59 | + 3. Click **Save**. |
| 60 | +5. Select **Syslog** > **Syslog Server**. |
| 61 | + 1. Check the **Allow user traffic to pass when TCP syslog server is down** checkbox. |
| 62 | + 2. Click **Add** to add a new syslog server: |
| 63 | + |
| 64 | + - **IP Address**: In the dropdown menu, select a network object that contains the IP address of the syslog server. If a network object is not created, click on the **plus (+)** to create a new network object. |
| 65 | + - **Protocol**: Click on either TCP or UDP protocol for syslog communication. |
| 66 | + - **Port**: Enter the port number on which the Datadog Agent is listening. |
| 67 | + - **Available Zones**: From the **Available Zones** list, click on the interface or zone where the syslog server is reachable, then click **Add** to move it to the **Selected Zones/Interfaces** column. |
| 68 | + |
| 69 | + 3. Click **OK**, then click **Save**. |
| 70 | +6. Go to **Deploy** > **Deployment** and deploy the policy to assigned devices. The changes are not active until you deploy them. |
| 71 | + |
| 72 | +**Note**: The `Port` value should be similar to the port provided in the `Log Collection` section. |
| 73 | + |
| 74 | +#### Configure Syslog on Cisco Meraki Firewall |
| 75 | + |
| 76 | +1. Log in to Cisco Meraki. |
| 77 | +2. Navigate to **Network-wide** > **Configure** > **General**. |
| 78 | +3. Navigate to **Reporting** > **Syslog Servers**. |
| 79 | +4. Click on **Add a syslog server**. |
| 80 | +5. Set the following configuration parameters: |
| 81 | + - **Server Address**: IP address of the syslog server |
| 82 | + - **Port**: port on which the syslog server is listening |
| 83 | + - **Protocol**: select TCP or UDP from the dropdown |
| 84 | + - **Roles**: select **Appliance Event Log** from the dropdown |
| 85 | +6. Click **Update syslog servers** to save the configuration. |
| 86 | + |
| 87 | +**Note**: The `Port` value should be similar to the port provided in the `Log Collection` section. |
| 88 | + |
| 89 | +#### Configure Syslog on Cisco ASA Firewall |
| 90 | + |
| 91 | +1. Connect to the Cisco ASA CLI. |
| 92 | +2. Enter the privileged EXEC mode by running the following; enter the password when prompted: |
| 93 | + ``` |
| 94 | + enable |
| 95 | + ``` |
| 96 | +3. Enable global configuration mode: |
| 97 | + ``` |
| 98 | + configure terminal |
| 99 | + ``` |
| 100 | +4. Enable logging: |
| 101 | + ``` |
| 102 | + logging enable |
| 103 | + ``` |
| 104 | +5. Configure syslog log forwarding, replacing the placeholders with the relevant values: |
| 105 | + |
| 106 | + * `<interface_name>`: the interface that the syslog server is associated with |
| 107 | + * `<ip_address>`: the IP address of the syslog server |
| 108 | + * `<port>`: the port where the syslog server is listening |
| 109 | + |
| 110 | + For UDP: |
| 111 | + ``` |
| 112 | + logging host <interface_name> <ip_address> udp/<port> |
| 113 | + ``` |
| 114 | + |
| 115 | + For TCP: |
| 116 | + ``` |
| 117 | + logging host <interface_name> <ip_address> tcp/<port> |
| 118 | + ``` |
| 119 | + |
| 120 | +6. Set the logging level to debug: |
| 121 | + ``` |
| 122 | + logging trap debugging |
| 123 | + ``` |
| 124 | + |
| 125 | +7. Enable rfc5424 timestamp format in syslog: |
| 126 | + ``` |
| 127 | + logging timestamp rfc5424 |
| 128 | + ``` |
| 129 | + |
| 130 | +**Note**: The `port` value should be similar to the port provided in the `Log Collection` section. |
| 131 | + |
| 132 | +### Validation |
| 133 | + |
| 134 | +[Run the Agent's status subcommand][2] and look for `cisco_secure_client` under the Logs Agent section. |
| 135 | + |
| 136 | +## Data Collected |
| 137 | + |
| 138 | +### Log Collection |
| 139 | + |
| 140 | +The Cisco Secure Client integration collects AnyConnect logs. |
| 141 | + |
| 142 | +### Metrics |
| 143 | + |
| 144 | +The Cisco Secure Client integration does not include any metrics. |
| 145 | + |
| 146 | +### Events |
| 147 | + |
| 148 | +The Cisco Secure Client integration does not include any events. |
| 149 | + |
| 150 | +## Troubleshooting |
| 151 | + |
| 152 | +**Permission denied while port binding:** |
| 153 | + |
| 154 | +Binding to a port number under 1024 requires elevated permissions. If you see a **Permission denied** error while port binding in the Agent logs: |
| 155 | + |
| 156 | +1. Grant access to the port using the `setcap` command: |
| 157 | + |
| 158 | + ```shell |
| 159 | + sudo setcap CAP_NET_BIND_SERVICE=+ep /opt/datadog-agent/bin/agent/agent |
| 160 | + ``` |
| 161 | + |
| 162 | + **Note**: Re-run this `setcap` command every time you upgrade the Agent. |
| 163 | + |
| 164 | +2. Verify the setup is correct by running the `getcap` command: |
| 165 | + |
| 166 | + ```shell |
| 167 | + sudo getcap /opt/datadog-agent/bin/agent/agent |
| 168 | + ``` |
| 169 | + |
| 170 | + You should see the following output: |
| 171 | + |
| 172 | + ```shell |
| 173 | + /opt/datadog-agent/bin/agent/agent = cap_net_bind_service+ep |
| 174 | + ``` |
| 175 | + |
| 176 | +3. [Restart the Agent][3]. |
| 177 | + |
| 178 | +**Data is not being collected:** |
| 179 | + |
| 180 | +Make sure that traffic is bypassed from the configured port if the firewall is enabled. |
| 181 | + |
| 182 | +**Port already in use:** |
| 183 | + |
| 184 | +On systems using syslog, if the Agent listens for logs on port 514, the following error can appear in the Agent logs: `Can't start UDP forwarder on port 514: listen udp :514: bind: address already in use`. |
| 185 | + |
| 186 | +By default, syslog listens on port 514. To resolve this error, take **one** of the following steps: |
| 187 | + |
| 188 | +- Disable syslog, or |
| 189 | +- Configure the Agent to listen on a different, available port. |
| 190 | + |
| 191 | +Need help? Contact [Datadog support][1]. |
| 192 | + |
| 193 | +[1]: https://docs.datadoghq.com/help/ |
| 194 | +[2]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information |
| 195 | +[3]: https://docs.datadoghq.com/agent/configuration/agent-commands/#start-stop-and-restart-the-agent |
| 196 | +[4]: https://www.cisco.com/site/in/en/products/security/secure-client/index.html |
| 197 | +[5]: https://docs.datadoghq.com/agent/guide/integration-management/?tab=linux#install |
| 198 | +[6]: https://github.com/DataDog/integrations-core/blob/master/cisco_secure_client/datadog_checks/cisco_secure_client/data/conf.yaml.example |
0 commit comments