topic Re: Virtual System (in VSX) Logging in Firewall and Security Management

Virtual System (in VSX) Logging

JSingh_N — Mon, 07 Aug 2023 11:52:24 GMT

Hi,

I have doubt in virtual system logging mechanism.

We have configured 2 dedicated log servers as primary log servers and 1 as backup log server in VS.

1.) When I run command "cpstat fw -f log_connection" I see primary log servers as connected but secondary / backup log server as disconnected.

2,) When I run command "tcpdump -nni any tcp port 257" in particular VS context, I am not able to see any traffic, also netstat -an | grep 257 does not show any connection.

3.) However, when I run "tcpdump -nni any tcp port 257" in VS0, then I am able to see the traffic for log servers and also able to see the connection established for 'netstat -an | grep 257'

In few of the VS, I see output of "cpstat fw -f log_connection" as disconnected for all three log servers but able to see logs in SmartConsole logs.

Please share your inputs regarding this behavior of VS logging.

Regards,

Jaspal Singh

Re: Virtual System (in VSX) Logging

G_W_Albrecht — Mon, 07 Aug 2023 12:59:37 GMT

Primary Log servers all receive the logs, but secondary is used when one or all primary log servers are unreachable.

Re: Virtual System (in VSX) Logging

JSingh_N — Mon, 07 Aug 2023 14:04:56 GMT

Ok, thanks for the revert. I got your point.

Could you please share your inputs for point 2 and 3 as well?

I think there is some mechanism in case of VSX env. that I am not aware of. May be some sort of mapping with VS0 or similar to this, I am not sure for now.

Re: Virtual System (in VSX) Logging

_Val_ — Mon, 07 Aug 2023 14:06:40 GMT

Logging for all VSs is done from VS0 context, this should cover 2 & 3

Re: Virtual System (in VSX) Logging

Bob_Zimmerman — Mon, 07 Aug 2023 16:54:59 GMT

Expanding on this, almost all outgoing traffic is sent from VS0. Traffic logs. Syslog data. DNS requests. NTP. RADIUS or TACACS for authentication.

VPN negotiations are the only thing I can think of offhand which originates from the firewall, but which leaves using the routing table of a VS other than 0.

Re: Virtual System (in VSX) Logging

JSingh_N — Tue, 08 Aug 2023 03:37:32 GMT

when I check in particular VS , "cpstat fw -f log_connection" showing primary log servers as disconnected but in VS0 same command output is 'connected.'