Losing logs after Installing a security policy

samerkilani — Tue, 06 Sep 2022 07:31:20 GMT

Hello everyone,

I have the following topology (screenshot attached):

A cluster with (2) firewalls and (1) Management Server, both firewalls forward logs to the management server and external log server.

My problem is whenever I published a policy, I lose receiving logs from both firewalls in the SmartConsole, but the external log server keeps receiving all logs as usual.

The way I used to workaround it is to remove the management server from the Log section in the cluster settings, publish the session then put the management server back and publish the policy again. But this workaround is not working anymore for no reason.

Please note that I tried tcpdump on both firewalls and the management server over port 257 but no packets have been captured, and I checked the management server it's listening on port 257.

I tried every possible solution I found on the internet with no result.

Anyone can help, please?

Thanks

Re: Losing logs after Installing a security policy

PhoneBoy — Tue, 06 Sep 2022 16:36:12 GMT

A couple questions:

What version/JHF level?
Is NAT involved at all? If so is it configured in the Management object?

So that we don’t waste time suggesting things you’ve already tried, please detail the precise things you’ve already done to try and resolve this issue with the precise results you received.
I suggest opening a TAC case in parallel if you haven’t already.

topic Losing logs after Installing a security policy in Firewall and Security Management

Losing logs after Installing a security policy

Re: Losing logs after Installing a security policy