Are logs in encrypted form while sending to management server?

[usmanshah526]

Hello All,

I have one query about logs if any one know the answer please reply the same.

query is between management servers and gateways logs sending in which format like plain text and encrypted form?

and if it’s sending logs in plain format is it possible to man in the middle attacker to read the logs while sending to management server?

[_Val_]

Logs are sent through a protected channel with certificate-based authentication. I would be very surprised if you manage to do MitM attach on that.

[usmanshah526]

Thanks for your reply is there any way we can show that logs was encrypted during forwarding logs management server,  because auditor ask they same questions to us and if is it mentioned in any document please share if you have any docs or articles related to this topic.

[Blason_R]

Its pretty simple - Capture the packet in your switch for port TCP/257 or even on mgmt server for port TCP/257. Try to read the logs. Since mgmt server is CA and then distributes certificates to difference component like firewalls and event viewer if deployed separately. The entire communication is encrypted using certificates

[the_rock]

I dont believe there is specific document saying so, but its been that way with CP since the beginning. @Blason_R  and @_Val_ are 100% correct!

[Chris_Atkinson]

Please refer to the section on SIC in the Security Management Admin Guide for your version, aswell as describing the encryption used by SIC it states this "trust" is required to send logs from Gateway to Management etc.

[Wolfgang]

@usmanshah526  you can find these information in the documentation Secure Internal Communication (SIC) 

encryption type, which communication is encrypted etc.

[the_rock]

Also, to add to this, any communication between mgmt and gateway would be encrypted. Think of basic scenario...lets say SIC breaks on the firewall and you have to reset it. Key you put on for sic reset, does not matter, can be 12345678, its a one time password thats encrypted and its gone, thats it. 

But, if you really need document stating than, I will let someone else provide it, as I had never seen one stating so.