Managing GWs via Public IP - Logs not arriving

[xiro]

Hi,

I have an issue where we have a Management Server in a DC, which should manage 2 firewall clusters that are on remote locations. 

Since there is no VPN-Tunnel between the DC and the foreign sites, we would prefer to manage them via public IP.

I've done the initial setup, created a static NAT to a public IP on the DC-FW (Cisco) for the mgmtsrv (192.168.1.1 <->70.80.90.100).

I'm able to install policies and make configuration changes, and also to fetch the policy vice versa.

Now since the setup is ready for further configuration and testing, I realized that I'm missing the logs from the remote clusters.

I checked all the logging settings in SC, they seem fine (mainly default).

The only thing that bothers me is the IP of the MGMT server. The main address of mgmtsrv is 192.168.1.1.

I assume that the GWs may try to send logs to the 192.168.1.1 IP, since the server itself doesn't really know that it is behind a public IP of 70.80.90.100. Normally there is a NAT-Option in the MGMT properties, which you can use to add a static NAT to the managed GWs. 

But since my server is "natted" by the Cisco ASA, I don't think that these settings for a static NAT are right. I assume if my Cisco ASA would be a CP, then this would be right and the server would communicate it's public NAT IP to the remote GWs, so they send the logs to the correct public address. But in this case I see no option where I could tell the server, that it should communicate it's IP as "70.80.90.100" to the GWs, because it's manually natted on the ASA.

Otherwise - would it be possible to create a new server object with the IP 70.80.90.100 and add it to the log servers for the GWs?

It's just a bit ugly to have 2 mgmtsrv in the dashboard where one serves as "IP-Dummy"... but if it works, I'd take it 🙂

But maybe I'm completely wrong and there's another issue that I'm not aware of.

I'm thankful for any hints 🙂

P.S: Communication between GWs and mgmtsrv is allowed bidirectional on all ports.

[JackPrendergast · Accepted solution]

Hello.

This is common, but there is a solution dont worry.

Firstly, can you check your masters file on the firewall? 

Go into expert mode and 'cd $FWDIR/conf' - and run 'less masters'

This should view a file that says something like:

[Policy]

xxx

[Log]

xxx

etc etc.

This is where the firewall is looking to obtain a policy and send logs to.

In your instance, you need to replace the hostname with your public IP(s) of your management server and log server.

Final step, you need to override a feature that keeps that file the same as a policy will over-write it.

Follow this SK, using GuiDBedit to ovveride this.

After you have completed the above, install database on your management server and push policy to your firewalls.

Logs will start to appear 🙂 

[xiro]

Many Thanks, that resolved it 🙂

[dehaasm]

Hi This was actually working for a while but now not anymore both database variables are configured on false after i change the master file to the public IP and perform policy install it returns to the old values, shall i involve TAC here?

[dehaasm]

when viewing log section in gateway properties we see it greyed out so that means it will not override these settings but it still does someway