> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/sources/cisco-asa.md).
# Cisco ASA
Receives syslog that a Cisco ASA (Adaptive Security Appliance) forwards to the collector over TCP or UDP, and parses the messages into structured logs. The collector binds a listen address and port; the ASA must be configured to export its syslog to that address.
### Supported Telemetry
| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Linux | | ✓ | |
| Windows | | ✓ | |
| macOS | | ✓ | |
### Prerequisites
* A Cisco ASA appliance that is reachable from the collector and configured to forward syslog to the collector's IP and listen port. For the ASA-side setup (enabling logging and adding the collector as a syslog server), follow Cisco's official documentation: [Configure logging on the Cisco Secure Firewall ASA](https://www.cisco.com/c/en/us/td/docs/security/asa/asa923/configuration/general/asa-923-general-config/monitor-syslog.html) (CLI) or [Configure ASA syslog using ASDM](https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html).
* The collector's listen port must be open in any host or cloud firewalls between the ASA and the collector.
* The ASA only permits syslog server destination ports in the range 1025–65535. The collector's default listen port (5140) is within this range. If you choose a different port, keep it in that range.
* Binding to a port below 1024 requires running the collector with root (Linux/macOS) or Administrator (Windows) privileges. The default port 5140 does not require elevated privileges.
### Configuration
**Logs**
| Parameter | Type | Required | Default | Description |
| -------------- | ------- | -------- | --------- | --------------------------------------------------------------------------------- |
| Listen Address | String | No | `0.0.0.0` | An IP address for the agent to bind. Typically `0.0.0.0` for most configurations. |
| Listen Port | Integer | No | `5140` | A TCP port which the agent will listen for syslog messages. |
**Advanced**
| Parameter | Type | Required | Default | Description |
| --------- | ------- | -------- | ------- | ------------------------------------------- |
| Parse | Boolean | No | `true` | Parses the log fields into structured data. |
### Examples
#### Receive ASA syslog on a non-default port
Bind the collector to all interfaces and listen on port 5514 for syslog forwarded by the ASA, parsing the messages into structured fields.
```yaml
- name: listen_ip
value: "0.0.0.0"
- name: listen_port
value: 5514
- name: parse
value: true
```
### Configuration Tips
* Set Listen Address to `0.0.0.0` to accept syslog on all interfaces, or to a specific interface IP to restrict where the collector accepts traffic.
* Keep the listen port in the 1025–65535 range so the ASA can target it; the ASA rejects destination ports outside that range.
* Leave Parse enabled to get structured fields. Disable it only if you need the raw syslog message preserved without field extraction.
### Troubleshooting
#### No logs arriving
Symptoms: the source is deployed but no Cisco ASA logs reach the pipeline.
Solutions:
1. Confirm the ASA is configured to send syslog to the collector's IP and listen port, and that logging is enabled on the device.
2. Verify the listen port is open in any host or cloud firewall between the ASA and the collector.
3. Confirm the ASA's destination port is in the 1025–65535 range; the ASA will not send to a port outside it.
#### Permission denied binding the listen port
Symptoms: the collector fails to start or bind, with a permission or address error.
Solutions:
1. If the listen port is below 1024, run the collector with root (Linux/macOS) or Administrator (Windows) privileges, or use a higher port such as the default 5140.
2. Confirm no other process is already bound to the listen address and port.
### Standalone Source
```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
name: cisco-asa
spec:
type: ciscoasa
parameters:
- name: listen_ip
value: "0.0.0.0"
- name: listen_port
value: 5140
- name: parse
value: true
```
### Related Resources
* [Configure logging on the Cisco Secure Firewall ASA (CLI)](https://www.cisco.com/c/en/us/td/docs/security/asa/asa923/configuration/general/asa-923-general-config/monitor-syslog.html)
* [Configure ASA syslog using ASDM](https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.bindplane.com/integrations/sources/cisco-asa.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.