topic Re: Syslog for SMB device obfuscated in Spark Firewall (SMB)

Syslog for SMB device obfuscated

Niag — Wed, 11 Mar 2020 08:47:40 GMT

Hi,

I'm sending syslogs to an external syslog server from a 1120 with firmware R77.20.80

My issue if that both Application and URL blade fields are shown as ******

appi_name="******" app_desc="******" app_id="******" app_category="******" matched_category="******" app_properties="******" app_risk="******" app_rule_id="******" app_rule_name="******"

Any ideas how I can deobfuscate these logs?

Re: Syslog for SMB device obfuscated

G_W_Albrecht — Wed, 11 Mar 2020 14:36:55 GMT

I would suggest to contact TAC - i never saw this issue with SMB devices, though...

Re: Syslog for SMB device obfuscated

Pedro_Espindola — Wed, 11 Mar 2020 15:02:39 GMT

You have to upgrade. On R77.20.87 there is a check box to obfuscate or not.

Re: Syslog for SMB device obfuscated

Niag — Wed, 11 Mar 2020 16:05:59 GMT

The latest firmware I can find for the 1120 is R77.20.80

Was any later firmware compatable?

Re: Syslog for SMB device obfuscated

PhoneBoy — Thu, 12 Mar 2020 00:21:49 GMT

No, R77.20.80 is considered the last compatible release.
The 1100 series was End of Sale in June 2017.
While I expect we will continue to fix bugs on the 1100 series until End of Support, we are not planning to release new software on the 1100 containing new features (which this effectively is).

Re: Syslog for SMB device obfuscated

Niag — Fri, 13 Mar 2020 11:05:48 GMT

Thanks for all the replies.

Is there any CLI kung fu that would enable this?

Re: Syslog for SMB device obfuscated

PhoneBoy — Fri, 13 Mar 2020 18:09:16 GMT

Possibly, but I'm not aware of what it is offhand.
Might be worth a TAC case.