topic Re: Take logging out of the implied rules in General Topics

Take logging out of the implied rules

D_TK — Fri, 11 Jul 2025 23:47:11 GMT

Happy Friday everyone.

Always running low on space on our current log server, so i've provisioned a new one with 40T of space and trying to get it receiving logs. This server is on the inside of my network and privately addressed, so i need the logs to traverse the VPN path.

Management is R82 and gateways are R81.20.

Per the guide, the salient implied rules file is: /opt/CPR8120CMP-R82/lib/implied_rules.def

So i made this change : /* #define ENABLE_FWD_LOG */

After pushing policy to a gateway the logging continues to go out on the implied rule 0.

Any ideas on what i've missed here would be appreciate.

Thanks.

Re: Take logging out of the implied rules

the_rock — Sat, 12 Jul 2025 14:29:32 GMT

If you go to smart console, security policy -> implied rules, see if its logged or not, you can uncheck it there.

Andy

Re: Take logging out of the implied rules

the_rock — Sat, 12 Jul 2025 14:33:56 GMT

@D_TK

I attached short video of what I meant. If this does not work, and what you tried failed as well, I would definitely verify with TAC.

Andy

Re: Take logging out of the implied rules

D_TK — Sat, 12 Jul 2025 17:36:17 GMT

Thanks Andy. I reread my initial post and i probably wasn't very clear. I don't want to change the actually logging of the traffic that matches the implied rules. I want to change the way the gateway communicates with the its log server - the actual tcp/257 traffic. And i only want to change this behavior for logging since i have logs and management separate, the normal management <-> gateway control connections would stay the same.

Per what i read and what i've done in the past for LDAP, this implied rule setting should control that.

- /* #define ENABLE_FWD_LOG */

I guess i'll open a tac on monday.

Have a great weekend.

Re: Take logging out of the implied rules

the_rock — Sat, 12 Jul 2025 17:49:57 GMT

I would get an official TAC response, agreed.

Have a good 1, as kids woukd say these days 🙂

Andy

Re: Take logging out of the implied rules

the_rock — Thu, 17 Jul 2025 23:19:34 GMT

Hey @D_TK

Were you able to figure this out?

Andy

Re: Take logging out of the implied rules

D_TK — Thu, 17 Jul 2025 23:25:00 GMT

with the help of a tac case, yeah. I'm "pretty" sure the order that i did was: modify implied rules file \ installed database only to the new log server \ and then pushed policy to the gateway.

Tac had me install database on everything - 2 log servers and management...and then push policy again. Started working immediately.

That's why we all have support!

Re: Take logging out of the implied rules

the_rock — Thu, 17 Jul 2025 23:26:10 GMT

Great news!