Syslog

[Sanjay_S]

Hi All,

We have to configure the new Syslog server on the VSX cluster. We have 4 firewalls in cluster and 2 environments VS0 and VS1.

Below is the requirement:

FW01-Should send logs on port 100

FW02-Should send logs on port 101

FW03-Should send logs on port 102

FW04-Should send logs on port 103

Please let us know how to achieve this as i did not find any documents related to this.

Thanks in advance.

[G_W_Albrecht]

Did you read sk87560: How to configure Security Gateway on Gaia OS to send FireWall logs to an external Syslog se... ? You can use syslog port 514 and use facility for the 4 GWs like in sk92798: How to configure custom Syslog rules on Gaia OS based on facility and priority

[Sanjay_S]

Thank you for the SKs Albrecht.

I want to use the customized ports for Syslogs and all the firewalls should send the logs on different ports. Based on the SKs and the Logging and Monitoring guide i do not see such kind of option. The only thing i see is default port 514 config. Any suggestions?

[G_W_Albrecht]

As the Logging and Monitoring R80.20 Administration Guide tells us:

To create a syslog server:

1. Open Object Explorer > New > Server > More > Syslog.
2. Configure these fields:
   • Name - Enter a name for this server, to be a unique network object.
   • Host - Select an existing host or click New to define a new computer or appliance.
   • Port - Enter the port number for syslog traffic. (Default = 514)
   • Version - Select BSD Protocol or Syslog Protocol.

To send the logs of a gateway to syslog servers:

• In SmartConsole on the gateway Properties > General Properties page > Management tab make sure Logging & Status is selected.
• On the Logs page, in the Send logs and alerts to these log servers table, click the green (+) button to add syslog servers.

  Note - You cannot configure a Syslog server as a backup server.

• Click OK.
• Install policy.

You would have to create 4 Syslog server entries with different ports 100 - 103 - worth a try, i think..

[Wolfgang]

@Sanjay_S 

@Sanjay_S  is talking about VSX, interesting to know if this will work with VSX.

Anyone tried this, sending logs to syslog server with virtual-systems ?

Wolfgang