I have installed Graylog v3.0.2 server to store log from F5 BIG-IP. The F5 is running with service CGNAT. When I configured on F5 to send logs to local-syslog(F5 itself), the server can receive CGNAT logs of F5, but when I configured on F5 to send logs directly via F5 LSN CGNAT publisher, the server can not receive the logs from F5. As a result of troubleshooting using tcpdump on F5, i see that F5 sending the logs out, but when i run tcpdump on the server, I don’t see any message receive from F5.
Thank you for your reading and help advise in advance.