Web: Example for Outputting IPv4 Session Logs to the eLog Log Host

Procedure

1. Important check items before configuration

   Before configuring the FW and eLog, pay attention to the following important check items and complete the configuration based on the actual situation:

   • The time zone and time of the FW shall be the same as those of the eLog.

     If the time zone or time of the FW is different from that of the eLog collector, log query results will be affected. You are advised to use NTP to make the FW and eLog as the clients to synchronize time from the clock source. If NTP is not deployed on the network, you can manually adjust the time on the FW to ensure time consistency between the FW and eLog.

   • Specify the method of managing the log source (that is, the FW) on the eLog.

     Currently, the eLog supports two FW management methods: manual adding and automatic discovery. You are advised to manually add the FW because this method is simple and you do not need to perform extra configuration on the FW. When there are a large number of FW, you can use the other method, automatic discovery. If this method is used, you need to set SNMP parameters on the FW.

2. Configure the FW.
   1. Check whether the time zone and time of the FW are the same as those of the eLog collector. In the case of inconsistency, choose System > Setup > Time to adjust the time zone or time of the FW. Check whether the time zone and time of the FW are consistent with those on the eLog collector. If not, choose System > Setup > Time to adjust the time zone and time of the FW.

      

   2. If the eLog manages FWs through automatic discovery, SNMP parameters must be configured on the FWs. However, if the eLog manages FWs through manual adding, skip this step. Configure SNMP parameters on FWs, so that they can be automatically discovered by the eLog. As SNMPv3 is securer than SNMPv1 or SNMPv2c, you are advised to use SNMPv3. At the same time, you are advised to use SHA2-256 as the authentication protocol and AES128 as the encryption protocol for higher security.

      

      

      When SNMP parameters are set using the web UI, the authentication algorithm is SHA2-256 and the encryption algorithm is AES128 by default, and cannot be changed. If you need to change these algorithms, run related commands.

   3. Configure security policies.

      1. Choose Policy > Security Policy > Security Policy.
      2. Click Add and configure a security policy from Trust to Untrust.

         

   4. Configure a NAT policy.

      Configure the NAT address pool and use the PAT mode (also the default mode).

      1. Choose Policy > NAT Policy > NAT Policy.
      2. Click the Source Translation Address Pool tab. Click Add and create a NAT address pool as follows. Click OK.

         Name	addr1
         IP Address Range	192.168.5.100-192.168.5.120

      Configure the NAT policy and reference the NAT address pool.

      1. Choose Policy > NAT Policy > NAT Policy > NAT Policy, click Add in NAT Policy List, and configure the NAT policy as follows. Click OK.

         Name	policy1
         NAT Type	NAT
         Source Zone	trust
         Destination Type	Destination Zone (untrust)
         Source Address	192.168.0.0/24
         Translated After
         Translated Mode	IP Address in the IP Address Pool
         Address Pool	addr1

   5. Configure the log host.
      # Set the IP address of the log host to 172.16.110.168, port number to 9002, and source IP address and source port for sending logs to 172.16.81.1 and 6666 respectively. (The eLog uses the session mode to collect logs.)

      1. Choose System > Log Configuration > Log Configuration.
      2. Configure binary session logs.

         

      

      In addition, log collection in netflow mode is supported. To view netflow session logs, set the port number to 9996. This document uses log collection in session mode as an example.

   6. Enable the session log function.

      # Enable the record function for session logs in the security policy for service traffic.

      Choose Policy > Security Policy > Security Policy, click the created security policy policy1, and enable the function of recording session logs in Other Options > Record Session Logs.

3. Configure the eLog.

   Assume that the eLog has been successfully installed; the collector works normally; and the disk space has been planned. Operations for managing log sources and viewing log reports on the eLog are as follows.

   For details about how to install and use the eLog, see the product documentation of the corresponding version in Technical Support > Product Support > Documentation > Security > eLog.

   1. Log in to the eLog using an administrator account.
   2. Choose System > System Management > Log Source List.
   3. Select the log source management method, manual adding or automatic discovery. Manual adding is recommended.

      • Manage log sources by manually adding them:

        1. Click and set the following parameters.

           

        2. Click OK. A message is displayed, indicating the configuration success.
        3. Click OK.

      • Manage log sources by automatically discovering them:

        1. Click and set the following parameters. The authentication and authorization protocol and password as well as the data encryption protocol and password must be consistent with the configuration on the FW.

           If there are many log sources on the network and these log sources are configured with the same SNMP parameters, you can create an SNMP parameter template on the eLog in advance, set the automatic discovery mode, and reference the SNMP parameter template to reduce the configuration workload.

           

        2. Click Start Discovery.
        3. After discovery is complete, the discovery result shows information about discovered log sources. In the Discovery Result dialog box, click Close.

   4. Choose System > System Management > Service Management.
   5. Click next to the collector. Then click in the Operation column of the collector.

      The collector configuration window is displayed.

   6. Click .
   7. Select log sources to be associated, as shown in the following figure:

      

   8. Click Next and configure the log collection mode.

      Configure the log collection mode on the eLog. Set the log collection mode to SESSION, port number to 9002 or Netflow, and port number to 9996. If the FW has the UTM feature, select Enable the UTM feature.

   9. Click Finish.