topic Syslog traffic in Firewall and Security Management

Syslog traffic

tavi0906 — Tue, 15 Jul 2025 04:56:41 GMT

Where should we find this setting “perform_cluster_hide_fold” ? is this setting for global level or for individual cluster VIP interface level ?

We are seeing the syslog traffic being sourced from VIP and one of the physical IP.

If the syslog traffic sourced from Virtual IP, how do we verify that the syslog data is being sent by both Active and Standby Firewall ?

Re: Syslog traffic

G_W_Albrecht — Tue, 15 Jul 2025 05:53:28 GMT

sk34180: Outgoing connections from cluster members are sent with cluster Virtual IP address instead of member's Physical IP address

sk154272: Changing the value of "perform_cluster_hide_fold" field does not change the ClusterXL behavior

Re: Syslog traffic

tavi0906 — Tue, 15 Jul 2025 06:02:14 GMT

“perform_cluster_hide_fold” ? is this setting for global level or for individual cluster VIP interface level ?

we are seeing the syslog traffic being sourced from VIP and one of the physical IP.

If the syslog traffic sourced from Virtual IP, how do we verify that the syslog data is being sent by both Active and Standby Firewall ?

Re: Syslog traffic

G_W_Albrecht — Tue, 15 Jul 2025 06:08:30 GMT

Please read sk34180 to learn that this is configured on cluster level, in Cluster Object in Security Management Server database.

Re: Syslog traffic

tavi0906 — Tue, 15 Jul 2025 10:33:42 GMT

If the syslog traffic sourced from Virtual IP, how do we verify that the syslog data is being sent by both Active and Standby Firewall ?

Re: Syslog traffic

G_W_Albrecht — Tue, 15 Jul 2025 10:36:11 GMT

What do you you want to know from StandBy member syslog ? Usually that member does nothing but sync some tables...

Re: syslog traffic

PhoneBoy — Tue, 15 Jul 2025 18:39:06 GMT

fw monitor from the standby member should show the standby member sending syslog (if it is doing so).

Re: Syslog traffic

Lesley — Tue, 15 Jul 2025 19:26:27 GMT

Do couple incorrect passwords on stand-by member this will trigger syslog event if you do it wrong often enough.

Also I suspect hostname is included in the syslog data, so you will see syslog from 1 IP only but in the data itself you can see if it is member 1 or 2.