Hero Image
Sending Cisco Firewall Logs to CloudWatch Without Drowning in Noise

Overview In an earlier post I set up SAML and MFA for VPN on a Cisco Firepower 1120 running ASA. Once that was in place, the next question was obvious: how do I know when something is wrong with the firewall without logging into ASDM every morning? We already ran most of our infrastructure in AWS, so Amazon CloudWatch was the natural place to land firewall logs. The first attempt worked, and it also sent everything. The log volume was noisy, expensive to keep, and useless for alerting. This post covers the version I ended up with: a small Linux syslog relay, a trimmed log stream, and a handful of metric filters that drive alarms and a dashboard.

Tuesday, April 14, 2026 Read
Hero Image
Configuring SAML and MFA on Cisco Firepower 1120

Overview Setting up SAML authentication with MFA on a Cisco Firepower 1120 for VPN access is essential for modern security requirements. Microsoft’s documentation provides a good starting point, but it’s missing critical CLI configuration commands for the Firepower side. This guide fills in those gaps and documents the lessons learned during implementation. Prerequisites Cisco Firepower 1120 with appropriate licensing and AnyConnect Microsoft Entra ID tenant with administrative access Access to Firepower via ASDM or CLI Your Firepower VPN’s public FQDN and SSL certificate configured Configuration Steps Step 1: Create the Enterprise Application in Azure Follow Microsoft’s guide to create the Cisco Secure Firewall app in Microsoft Entra ID:

Tuesday, August 12, 2025 Read